SUSE CVE-2026-93294

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

CVE-2026-93294

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

EUVD-2026-98903

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

CVE-2026-93294 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

CVE-2026-93294

The Azure Monitor data source contains a vulnerability where a user with query access can leverage its resource proxy as an unintended proxy. This allows the user to call Azure Resource Manager APIs beyond the scope required by Grafana , performing actions using the data source's Azure identity ....

CVE-2026-93294 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

PT-2026-111742

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An unintended proxy issue exists where a user with query access to an Azure Monitor data source can utilize its resource proxy to make calls to Azure Resource Manager APIs that exceed the...

CVE-2026-93294: Unintended Proxy or Intermediary

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

CVE-2026-94205: Unintended Proxy or Intermediary

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are merged into the...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via insufficient hardening of runtime option handling in the fetch and HTTP adapters...

CVE-2026-69399: Unintended Proxy or Intermediary

Azure Arc Elevation of Privilege Vulnerability...

Microsoft Windows Speech Tampering Vulnerability

Unintended proxy or intermediary 'confused deputy' in Microsoft Windows Speech allows an authorized attacker to perform tampering locally...

CVE-2026-73424: Unintended Proxy or Intermediary

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-72640: Unintended Proxy or Intermediary

The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissio...

CVE-2026-43910: Unintended Proxy or Intermediary

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-42933 Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-42933 Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

Kibana 9.4.3 Security Update (ESA-2026-54)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the httpapi.RequestHost process. An attacker can gain unauthorized access to sensitive data by sending requests with a crafted X-Forwarded-Host header, which is trusted over the real...