1271 matches found
CVE-2026-21725
A time-of-create-to-time-of-use TOCTOU vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion...
CVE-2026-21725 Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
A time-of-create-to-time-of-use TOCTOU vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion...
CVE-2026-21725
CVE-2026-21725 describes a TOCTOU issue in Grafana data sources where a recently deleted-then-recreated datasource can be re-deleted by an attacker. Conditions include admin access before first deletion, a 30-second window on the same pod, the attacker deleting the datasource, a recreate by anoth...
CVE-2026-21725
A time-of-create-to-time-of-use TOCTOU vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion...
Authorization bypass in Grafana datasource deletion
A time-of-create-to-time-of-use TOCTOU vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: The attacker must have admin access to the specific datasource prior to its first deletion...
PT-2026-21901
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A time-of-create-to-time-of-use TOCTOU issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to...
CVE-2026-26963
A flaw was found in Cilium. When specific network configurations, including Native Routing, WireGuard, and Node Encryption, are enabled, Cilium incorrectly allows network traffic from Pods on other nodes. This can lead to unauthorized access to network communications and potential information...
Cilium 安全漏洞
Cilium is an open-source software developed by Cilium contributors. It is used to provide and transparently protect network connections and load balancing between application workloads, such as application containers or processes. Versions of Cilium from 1.18.0 to 1.18.5 contain security...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the handler process. An attacker can trigger unauthorized WASM module execution in the controller context by sending crafted AdmissionReview requests directly to webhook endpoints from an...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, gcp-compute-persistent-disk-csi-driver, argo-rollouts, helm-operator, controller-gen, mariadb-operator, kuma, nri-prometheus, cluster-api, minio-object-browser, croc, tigera-operator,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, velero-plugin-for-microsoft-azure, configmap-reload, gcp-compute-persistent-disk-csi-driver, argo-rollouts, helm-operator, controller-gen, mariadb-operator, kuma, jaeger, gobump, nri-prometheus,...
GHSA-H355-32PF-P2XM vulnerabilities
Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, gcp-compute-persistent-disk-csi-driver, argo-rollouts, helm-operator, controller-gen, mariadb-operator, kuma, nri-prometheus, cluster-api, minio-object-browser, croc, tigera-operator,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, cni-plugins, grype-fips, oras-fips, aws-signer-notation-plugin, packer-fips, crossplane-provider-terraform, git-credential-oauth, cue, crossplane-provider-aws-s3, amazon-ssm-agent, rclone-fips,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, cni-plugins, grype-fips, oras-fips, aws-signer-notation-plugin, packer-fips, crossplane-provider-terraform, git-credential-oauth, cue, crossplane-provider-aws-s3, amazon-ssm-agent, rclone-fips,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, grype-fips, oras-fips, aws-signer-notation-plugin, packer-fips, crossplane-provider-terraform, git-credential-oauth, cue, crossplane-provider-aws-s3, amazon-ssm-agent, rclone-fips, descheduler-fips,...
SUSE CVE-2026-24514
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...
GHSA-2PF9-VR92-6H3V ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...
PT-2026-6347
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...
CVE-2026-24514
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...
CVE-2026-24514 ingress-nginx Admission Controller denial of service
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx...