BIT-GRAFANA-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-19943

creationtimestamp| type| source ---|---|--- 2026-08-25 08:15:08+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-19943...

CVE-2026-17089

creationtimestamp| type| source ---|---|--- 2026-08-25 08:15:06+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-17089 2026-09-22 23:00:08+00:00| seen| https://t.me/GithubRedTeam/103082 2026-09-22 23:00:08+00:00| published-proof-of-concept|...

CVE-2026-14280

creationtimestamp| type| source ---|---|--- 2026-08-25 08:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-14280...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-68519

A flaw was found in Glances. This issue occurs because the --disable-config-exec option does not properly prevent on-alert action commands from executing shell operators. A local attacker with high privileges could exploit this to execute arbitrary commands, leading to high impact on...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: The issue in ieee80211scanrx involves checking the skb length. This code requires hard-coded compile-time constants for determining the header length check. Instead, a dynamic determination based on the frame type shoul...

CVE-2026-78182

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78182...

CVE-2026-78185

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:19+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78185...

CVE-2026-78212

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:17+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78212...

CVE-2026-78180

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:12+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78180...

CVE-2026-78181

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:10+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78181...

CVE-2026-19853

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:08+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-19853...

WordPress SMS Alert plugin < 3.9.8 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Sai Praneeth Koti in WordPress Plugin SMS Alert Order Notifications versions 3.9.8...

SUSE CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CGA-Q983-RG4W-2RGG

Bulletin has no description...

CVE-2026-70105

creationtimestamp| type| source ---|---|--- 2026-08-21 08:45:22+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2027 2026-08-21 13:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtlv5jzfex26...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

EUVD-2026-62915

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...

EUVD-2026-63125

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could...