8019 matches found
EUVD-2026-36599
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing...
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: prometheus-operator, omnictl-multiarch-fips, telegraf, gatekeeper, zitadel, etcd-fips, containerd, drone-fips, grafana, calico-fips, etcd, gitlab-kas, tekton-pipelines-fips, minio, kubernetes, argocd-image-updater, seaweedfs-rocksdb-fips, snyk-cli, argo-cd-fips,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: gatus, apko, tekton-chains, crossplane-provider-aws-cloudfront, argo-events, zarf, flux-source-controller, istio, step-issuer, ko, crossplane-provider-aws-eks, terraform-provider-acme, traefik, kots, docker-cli-buildx, docker-compose,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: gatus, apko, tekton-chains, argo-events, zarf, flux-source-controller, istio, step-issuer, ko, kots, docker-cli-buildx, flux-notification-controller, neuvector-sigstore-interface, flux-image-automation-controller, sops, fscrypt, prometheus,...
GHSA-X527-X647-Q7GG vulnerabilities
Vulnerabilities for packages: spire-server, kubernetes, argocd-image-updater, zarf, flux-source-controller, opentelemetry-collector, istio, mattermost, snyk-cli, k9s, loki, flux, kubescape, cilium, cilium-cli, kots, external-dns, rancher, aactl, flux-image-automation-controller, k3s, fscrypt,...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: spire-server, kubernetes, argocd-image-updater, zarf, flux-source-controller, opentelemetry-collector, istio, mattermost, snyk-cli, k9s, loki, flux, kubescape, cilium, cilium-cli, kots, external-dns, rancher, aactl, flux-image-automation-controller, k3s, fscrypt,...
GHSA-78MQ-XCR3-XM33 vulnerabilities
Vulnerabilities for packages: spire-server, opentofu, kubernetes, apko, argocd-image-updater, argo-events, zarf, flux-source-controller, opentelemetry-collector, istio, podman, mattermost, grype, scorecard, snyk-cli, pulumi-kubernetes-operator, k9s, loki, nuclei, flux, nfpm, kubescape, cilium,...
GHSA-9M57-25V3-79X9 vulnerabilities
Vulnerabilities for packages: spire-server, opentofu, kubernetes, opentelemetry-collector, istio, podman, mattermost, snyk-cli, loki, flux, cilium-cli, cilium, buildah, kots, external-dns, docker-cli-buildx, rancher, aactl, k3s, fscrypt, prometheus, kaf, kine, kyverno, containerd, minio,...
GHSA-JPPX-RXG9-JMRX vulnerabilities
Vulnerabilities for packages: spire-server, kubernetes, opentelemetry-collector, istio, podman, mattermost, snyk-cli, loki, flux, cilium-cli, cilium, buildah, kots, external-dns, docker-cli-buildx, rancher, aactl, k3s, fscrypt, prometheus, kaf, kine, kyverno, containerd, minio,...
BIT-GRAFANA-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...
FreeBSD : Gitlab -- Vulnerabilities (ee1e7aef-7117-11f1-873f-2cf05da270f3)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ee1e7aef-7117-11f1-873f-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE Cross-site...
PT-2026-52860
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...
GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...
CVE-2026-56761 vulnerabilities
Vulnerabilities for packages: langfuse, langfuse-fips, librechat, kibana, wazuh-dashboard...
GO-2026-5328 Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...
EUVD-2026-39139
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...