CVE-2026-19854

A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security TLS, causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

EUVD-2026-102961

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual versions through 1.1.2 are vulnerable to a missing authorization (CWE-862) flaw within the /api/v2/reports handlers. This security weakness allows authenticated users with low privileges to access ClickHouse instances they are not authorized to view. By iterating the instance-id param...

PT-2026-116069

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-51992

CVE-2026-51992 Within ClickHouse, a feature exists that allows a user with the correct permissions to create dictionaries in order to interact with different databases and run specific queries on them. For PostgreSQL, SELECT queries are wrapped in a COPY QUERY TO STDOUT statement before being...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-aws-backup, clickhouse-backup, fortio-fips, kube-rbac-proxy-fips, kubernetes-csi-external-attacher-fips, chartmuseum, virt-handler, kubernetes-dashboard-auth-fips, aws-flb-kinesis-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-aws-backup, clickhouse-backup, fortio-fips, kube-rbac-proxy-fips, kubernetes-csi-external-attacher-fips, chartmuseum, virt-handler, extension-host-fips, kubernetes-dashboard-auth-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-aws-backup, clickhouse-backup, fortio-fips, kube-rbac-proxy-fips, kubernetes-csi-external-attacher-fips, chartmuseum, virt-handler, extension-host-fips, kubernetes-dashboard-auth-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-aws-backup, clickhouse-backup, fortio-fips, kube-rbac-proxy-fips, kubernetes-csi-external-attacher-fips, chartmuseum, virt-handler, extension-host-fips, kubernetes-dashboard-auth-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, cert-manager-csi-driver, argo-events, witness,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, nri-couchbase, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, s5cmd, cert-manager-csi-driver,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, nri-couchbase, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, consul-k8s, addon-resizer, s5cmd, cert-manager-csi-driver, argo-events, witness,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, nri-couchbase, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, s5cmd, cert-manager-csi-driver,...

CVE-2026-78663 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, cert-manager-csi-driver, argo-events, witness,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, nri-couchbase, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, s5cmd, cert-manager-csi-driver,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, velero-plugin-for-aws, knative-serving, whereabouts, envoy-ratelimit, nri-couchbase, q, falcoctl, crossplane-provider-aws-dynamodb, wolfictl, terraform-docs, consul-k8s, addon-resizer, s5cmd, cert-manager-csi-driver,...

agent-utilities (>=0.41.0, <=0.51.0), clai (>=1.77.0, <=1.107.6) +37 more potentially affected by CVE-2026-107287 via pydantic-ai-slim (>=1.77.0, <=1.107.6)

pydantic-ai-slim PYPI version =1.77.0, =0.41.0, =1.77.0, =0.0.445, =1.0.0, =1.1.0, =1.0.25, =0.1.102, =26.1.0, =0.1.1, =0.2.0, =0.2.1 - jupydeep 0.1.6 and more Source cves: CVE-2026-107287 Source advisory: MEND:CVE-2026-107287...