7980 matches found
GO-2026-5824 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
MAL-2026-7419 Malicious code in shiphero-dashboard (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1084 Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations
aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...
PYSEC-2026-2027 Voilà Local file inclusion
Impact Any deployment of voilà dashboard allow local file inclusion, that is to say any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how...
PYSEC-2026-1327 ESPHome vulnerable to Authentication bypass via Cross site request forgery
Summary API endpoints in dashboard component of ESPHome version 2023.12.9 command line installation are vulnerable to Cross-Site Request Forgery CSRF allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files create, edit,...
PYSEC-2026-1328 ESPHome vulnerable to remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...
PYSEC-2026-1158 Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...
PYSEC-2026-1180 Apache Superset incorrect write permissions vulnerability
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2...
PYSEC-2026-1157 Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0...
PYSEC-2026-778 Apache Superset has Improper Access Control
When explicitly enabling the feature flag DASHBOARDCACHE disabled by default, the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...
Apache Superset vulnerable to Cross-site Scripting
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...
PYSEC-2026-779 Apache Superset vulnerable to Cross-site Scripting
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...
PT-2026-56253
Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description Dashboard text components render stored content using Vue v-html without server-side HTML sanitization. This allows an authenticated user with permissions to edit dashboard component data to injec...
GHSA-7QW2-F75V-62F7 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
Summary The AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Note:...
GHSA-H6Q6-9HQW-RWFV vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips...
CVE-2022-39353 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips...
CVE-2021-32796 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips...
GHSA-5FG8-2547-MR8Q vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips...