Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Lablup Clear all filters
TI-2025-31625 CVE-2025-49653 · GHSA-hxvr-gg2w-j48x

Exposure of sensitive Information allows account takeover

Priority HIGH 70

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00349 Published 2025-06-09 No fix listed CWE-200
TI-2025-31624 CVE-2025-49652 · GHSA-ww28-4m4v-cq4j

Improper access control allows arbitrary account creation

Priority HIGH 82

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00446 Published 2025-06-09 Fixed in 25.15.6, 25.19.0rc1 CWE-306
TI-2025-31623 CVE-2025-49651 · GHSA-h889-475r-wfmm

Missing Authorization for Interactive Sessions

Priority HIGH 70

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00353 Published 2025-06-09 No fix listed CWE-862