CVE-2026-63199

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

GHSA-4227-9989-JRHX Perses's missing authorization in datasource proxy allows cross-scope secret disclosure

Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret...

Perses's missing authorization in datasource proxy allows cross-scope secret disclosure

Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret...

CVE-2026-63199

Perses (open-source observability dashboard) versions 0.43.0 through 0.54.0-rc.0 contain a missing authorization check in the datasource creation and unsaved datasource proxy paths. The proxy verifies the caller's Datasource or GlobalDatasource scope but fails to require read permission on the se...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

EUVD-2026-83267

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

CVE-2026-53557

SQLBot , an intelligent Text-to-SQL system built on LLMs and RAG, contains a second-order SQL injection in its Excel datasource handling. Prior to 1.9.0 , an authenticated user can supply a crafted sheet["tableName"] value via POST /api/v1/datasource/, which is stored without safe identifier hand...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

grafana: Grafana: Denial of Service due to Out of Memory via $__timeGroup macro

A flaw was found in Grafana. A remote attacker with authenticated access to a SQL datasource can exploit a vulnerability in the $timeGroup macro. By sending specially crafted queries, an attacker can cause an Out of Memory OOM error, leading to the Grafana server crashing and resulting in a Denia...

CVE-2026-53554: Improper Limitation of a Pathname to a Restricted Directory

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

PT-2026-95139

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation RAG. An authenticated user can submit a crafted tableName value within the Excel datasource...

PT-2026-95136

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description The system improperly handles multipart filename data when processing uploads. Specifically, the 'POST /api/v1/datasource/parseExcel' endpoint writes uploaded content to disk before completing...

PT-2026-95138

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...

grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...