1863 matches found
RHEL 9 : grafana (RHSA-2026:58982)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58982 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana:...
ALSA-2026:58982 Moderate: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default...
Moderate: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default...
CVE-2026-76876
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...
CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...
cve-2026-59307 - HIGH - Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
cve-2026-59307 - HIGH - Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference...
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the jsonTypeId message header to an arbitrary class without an allow-list...
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...
CVE-2026-68561
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
EUVD-2026-62703
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-68561
Wekan (open-source kanban built with Meteor) prior to 9.89 has a privilege escalation flaw in server/permissions/boards.js. The canUpdateBoardSort check authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete mo...
CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-68561 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
CVE-2026-50152
A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contai...
PT-2026-78651
Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...
EUVD-2026-61008
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
GO-2026-6223 Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) in github.com/argoproj/argo-workflows
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892 in github.com/argoproj/argo-workflows...
ANT-2026-BVDWY3J9 · supabase/auth · open-redirect
open-redirect medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BVDWY3J9: Redirect allow-list ignores URL scheme and port In supabase/auth, IsRedirectURLValid...