GO-2026-6664 Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana

Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2026-107175

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...

EUVD-2026-94314

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789289678)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789289678 advisory. - A cross-tenant isolation vulnerability was found in Grafana's Correlations feature affecting legacy correlation records. Due to ...

Enhancing the Security of Coherent One-Way Quantum Key Distribution Using CHSH Correlations

The coherent one-way COW protocol is a quantum key distribution scheme that has attracted significant attention, leading to the development and commercialization of practical implementations. Despite this progress, the security of the COW protocol has remained a fundamental challenge since its...

Security Evaluation of Laser-Phase-Noise Quantum Random Number Generators with Intrinsic Correlations

Quantum random number generators are essential for achieving information-theoretical security in modern cryptographic systems. Among various implementations, laser phase noise schemes are widely favored for their simple architecture and high integration potential. However, the intrinsic...

On-Chip Quantum Randomness Amplification

Randomness amplification, the task of extracting uniform private bits from biased seeds that may be partly known by a malicious third party, is of central importance in cryptography. The highest security in this task is provided by a class of quantum protocols known as device-independent, which...

CVE-2026-10863

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863 MISP User-controlled order parameter in correlations over-correlation endpoint

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863

CVE-2026-10863 affects the correlations over-correlation endpoint in the application, specifically the overCorrelations() function in app/Controller/CorrelationsController.php. The vulnerability arises from accepting an order parameter from user-controlled named request parameters, which could al...

EUVD-2026-34265

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863 MISP User-controlled order parameter in correlations over-correlation endpoint

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-10863

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

PT-2026-46237

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists in the 'over-correlation' endpoint where the order query parameter is accepted from user-controlled named request parameters. This allows an...

CVE-2026-10863: Improper Input Validation

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

SUSE CVE-2026-21727

A cross-tenant isolation vulnerability was found in Grafana's Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing orgid = 0 records to be returned across organizations, a user with datasource management privileges could read and permanentl...

GHSA-P5X9-J974-RPFP Grafana legacy correlations allow cross-tenant disclosure and deletion

--- hero: image: /static/img/heros/hero-legal2.svg content: " Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana fixedversions: - "=11.6.11 =12.0.9 =12.1.6 =12.2.4" --- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature...

Grafana legacy correlations allow cross-tenant disclosure and deletion

--- hero: image: /static/img/heros/hero-legal2.svg content: " Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana fixedversions: - "=11.6.11 =12.0.9 =12.1.6 =12.2.4" --- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature...