lunary vulnerabilities

Recent CVEs affecting lunary products. 43 tracked.

lunary has 43 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 31. Most recent: 2026-02-02. Highest priority: CVE-2024-7456 (score 62/100).

• CVE-2025-9803 HIGH 8.8 DOWNGRADE lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo
• CVE-2025-5352 CRITICAL 9.6 UPGRADE A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna
• CVE-2025-4779 MEDIUM 6.1 UPGRADE lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS)
• CVE-2025-0281 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier
• CVE-2024-9099 HIGH 8.1 DOWNGRADE In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f
• CVE-2024-9098 MEDIUM 6.1 UPGRADE In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite
• CVE-2024-9096 HIGH 7.1 DOWNGRADE In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists
• CVE-2024-9095 CRITICAL 9.8 DOWNGRADE In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-
• CVE-2024-9000 MEDIUM 6.5 DOWNGRADE In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify che
• CVE-2024-8999 HIGH 7.5 UPGRADE lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-wa
• CVE-2024-8998 HIGH 7.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845
• CVE-2024-8789 HIGH 7.5 UPGRADE Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack
• CVE-2024-8765 HIGH 7.3 UPGRADE In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4
• CVE-2024-8764 HIGH 7.5 UPGRADE A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regula
• CVE-2024-8763 HIGH 7.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specif
• CVE-2024-7476 MEDIUM 4.3 UPGRADE A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2
• CVE-2024-7475 CRITICAL 9.1 UPGRADE An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SA
• CVE-2024-7474 HIGH 8.1 UPGRADE In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists
• CVE-2024-7473 MEDIUM 6.5 DOWNGRADE An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary
• CVE-2024-7472 MEDIUM 6.5 DOWNGRADE lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/use
• CVE-2024-7456 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2
• CVE-2024-6867 MEDIUM 6.5 DOWNGRADE An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/rel
• CVE-2024-6862 HIGH 8.1 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly perm
• CVE-2024-6582 MEDIUM 4.3 UPGRADE A broken access control vulnerability exists in the latest version of lunary-ai/lunary
• CVE-2024-6087 MEDIUM 6.5 UPGRADE An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main
• CVE-2024-6086 MEDIUM 4.3 DOWNGRADE In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of
• CVE-2024-5755 MEDIUM 5.3 UPGRADE In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.')
• CVE-2024-5714 MEDIUM 6.8 DOWNGRADE In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team managemen
• CVE-2024-5386 HIGH 8.8 UPGRADE In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea
• CVE-2024-4147 MEDIUM 6.5 UPGRADE In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t
• CVE-2024-3760 HIGH 7.5 UPGRADE In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an
• CVE-2024-3502 HIGH 8.1 UPGRADE In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where a
• CVE-2024-3501 HIGH 8.1 UPGRADE In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to
• CVE-2024-3379 HIGH 8.1 UPGRADE In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged
• CVE-2024-11301 MEDIUM 6.5 UPGRADE In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing
• CVE-2024-11300 MEDIUM 6.5 UPGRADE In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc
• CVE-2024-11137 HIGH 7.5 UPGRADE An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of
• CVE-2024-10762 HIGH 8.1 UPGRADE In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a
• CVE-2024-10330 MEDIUM 6.5 UPGRADE In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any us
• CVE-2024-10275 HIGH 7.3 UPGRADE In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions
• CVE-2024-10274 MEDIUM 6.5 UPGRADE An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5
• CVE-2024-10273 MEDIUM 6.5 UPGRADE In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles
• CVE-2024-10272 HIGH 7.5 UPGRADE lunary-ai/lunary is vulnerable to broken access control in the latest version

FAQ

How do I fix lunary vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is lunary being exploited right now?

None of the tracked lunary CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which lunary CVE should I patch first?

CVE-2024-7456 currently ranks highest (62/100): A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2.

Products

• lunary

RSS feed for lunary · ← Back to latest CVEs