zannotate

ZAnnotate ZAnnotate is a Go utility that facilitates annotating large IP datasets with network metadata. Right now this includes: CLI Flag| Description| Needs API Key| Needs Data Download ---|---|---|--- --censys| Censys internet intelligence live API| Yes| --cymru| Cymru IP Origin/Peer ASN and A...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

spiderfoot

SpiderFoot is an open source intelligence OSINT automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate. SpiderFoot has an embedded web-server for providing a clean and intuitive web-based...

coeus-ci

Coeus CI Competitive Intelligence that sees all. Named after Coeus SEE-us, the 100 eyed Greek Titan of the inquisitive mind — whose name literally means "querying." CI stands for Competitive Intelligence. A business intelligence OSINT tool that builds company profiles from free public data source...

CLEANSTART-2026-VU18378 time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so

Security vulnerability affects the grafana package. A time-of-create-to-time-of-use TOCTOU vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so...

CVE-2022-24818

CVE-2022-24818: Java Deserialization via Unchecked JNDI Lookups in GeoServer and GeoTools The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. As an example thi...

Drupal Central Authentication System Server input validation error vulnerability

The Drupal Central Authentication System Server versions prior to 0.0.0 and 2.0.4, as well as versions prior to 2.1.0 and 2.1.3, contain an input validation error vulnerability. This vulnerability stems from URL redirection to untrusted sites open redirect, potentially leading to forged data...

Drupal SAML SSO – Service Provider input validation error vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain an input validation error vulnerability. This vulnerability stems from URL redirection to untrusted sites open redirect, potentially allowing attackers to forge data sources...

TencentOS Server 4: grafana (TSSA-2026:1180)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1180 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1792076604)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792076604 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1792076604)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792076604 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...

CVE-2026-110868

A flaw was found in Renovate. A Server-Side Request Forgery SSRF vulnerability allows an attacker to coerce the shared HTTP client into sending requests to arbitrary internal network addresses through crafted presets or custom data sources. This issue primarily leads to sensitive information...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards...

CVE-2026-81841: Missing Authorization

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: "files/extra" is resolved via path operations that follow symlinks, and blob...

CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

Flatpak path traversal vulnerability

Flatpak has a path traversal vulnerability. This vulnerability arises because the files/extra path operations in the extractextradata function follow symbolic links, and the blob names in xa.extra-data-sources are not protected against path traversal. As a result, malicious or compromised Flatpak...

EUVD-2026-70104

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

EUVD-2026-67691

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...