1336 matches found
CVE-2026-22641
This CVE entry concerns Grafana's datasource proxy API. The root cause is an extra slash in the URL path that bypasses authorization checks, allowing unauthorized read access to GET endpoints in Alertmanager and Prometheus-based datasources. Affected components are datasources implementing route-...
EUVD-2026-2803
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...
CVE-2026-22641
...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003546)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003546 advisory. In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows local users to cause a denial of service...
PT-2026-3008
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A flaw exists in Grafana’s datasource proxy API that permits bypassing authorization checks. This is achieved by including an additional slash character within the URL path. Users with limite...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003527)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003527 advisory. In the tun subsystem in the Linux kernel before 4.13.14, devgetvalidname is not called before registernetdevice. This allows local users to cause a denial of service...
CVE-2018-21254
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...
CVE-2022-38794
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring...
CVE-2017-18886
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
CVE-2017-18881
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...
CVE-2019-20862
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...
CVE-2025-15382
A heap buffer over-read vulnerability exists in the wolfSSHCleanPath function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte...
CLSA-2026-1767808644 curl: Fix of CVE-2025-9086
CVE-2025-9086: cookie: don't treat the leading slash as trailing...
CLSA-2026-1767807099 curl: Fix of CVE-2025-9086
CVE-2025-9086: cookie: don't treat the leading slash as trailing...
CVE-2025-46256
CVE-2025-46256 relates to WordPress Advanced Database Cleaner PRO before or up to 3.2.10, with a Limited .txt Path Traversal vulnerability. Affected software is the Advanced Database Cleaner PRO plugin (SigmaPlugin implementation). Impact described as path traversal; CVSS v3.1 base score 6.4 (NET...
SUSE CVE-2017-18886
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
SUSE CVE-2017-18889
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...
Alibaba Cloud Linux 3 : 0199: curl (ALINUX3-SA-2025:0199)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0199 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-9086: 1. A cookie is set using the secure...
