Alert rules in restricted folders disclosed via the alert rules list API

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

Fedora 45 : python-quart-trio / python-streamlink / python-urllib3 (2026-9a652403b1)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9a652403b1 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

CVE-2026-65102: Integer Overflow or Wraparound

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering...

CVE-2026-86157: Exposed Dangerous Method or Function

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-101859: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

PT-2026-102427

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the OpenVPN Configuration Handler component. The issue occurs within the escapeshellcmd function located in the ajax/openvpn/del ovpncfg.php file. ...

PT-2026-102740

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

PT-2026-102734

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

PT-2026-102780

Marmite through 0.4.2 contains missing authentication in the development server endpoints / marmite /content, / marmite /config, and / marmite /file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path...

Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083: Missing Authentication for Critical Function

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-102826: Improper Neutralization of Special Elements used in a Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone. The...

PT-2026-102428

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description Improper privilege management occurs within the PluginInstaller::addSudoers function located in the src/RaspAP/Plugins/PluginInstaller.php file of the sudo Configuration component. This...

SUSE CVE-2026-88808

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

SUSE CVE-2026-93539

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

SUSE CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-102005 VxWorks Memory Allocation

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09...

CVE-2026-101908

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

CVE-2026-98153

A flaw was found in the Linux kernel's NVMe driver. A race condition can lead to a denial of service DoS or memory corruption when multiple paths scan the same shared namespace concurrently. Because access to the Flexible Data Placement FDP configuration data is unprotected during initialization,...