https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:32:01.874742+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-22680 CVE-2026-22680 — OpenViking < 0.3.3 Missing Authorization via Task Polling 2026-10-05T21:32:01.876879+00:00

Affected: Volcengine OpenViking

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

 https://cve.radiocsirt.org/vuln/ghsa-h336-2wxm-pr6q GHSA-h336-2wxm-pr6q — OpenViking contains a missing authorization vulnerability in the task polling endpoints 2026-10-05T21:32:01.876947+00:00

Affected: PyPI: OpenViking

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.