Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Summary fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves...

GHSA-5C25-7VPJ-9MQH Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Summary fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves...

GHSA-X6FG-52VR-HJ4W Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...

EUVD-2026-36599

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing...

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, omnictl-multiarch-fips, seaweedfs-rocksdb, vault-fips, cilium, gitlab-kas, commercial-expanso-edge, argo-cd, traefik-fips, trivy, skaffold, minio-fips, tekton-pipelines, flux-source-controller-fips, kubescape, docker-machine-driver-harvester,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: kots, terraform-provider-tls, k8sgpt, flux-kustomize-controller, gitlab-pages, wal-g, pulumi-kubernetes-operator, hcloud, ksops, cosign, k3s, step, gitlab-kas, zarf, crossplane-provider-aws-lambda, crossplane-provider-aws-cloudformation, terragrunt, sealed-secrets,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kots, terraform-provider-tls, k8sgpt, flux-kustomize-controller, wal-g, pulumi-kubernetes-operator, hcloud, ksops, cosign, k3s, step, gitlab-kas, zarf, terragrunt, melange, kargo, grype, crossplane-provider-azure-managedidentity, scorecard, trivy-operator,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kots, kyverno, osv-scanner, spire-server, k9s, kubernetes-dashboard, k3s, cloud-provider-aws, zarf, gitlab-kas, prometheus-operator, skaffold, rancher, flux-source-controller, kubernetes, fscrypt, flux-image-automation-controller, flux, external-dns,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kots, kyverno, osv-scanner, spire-server, k9s, kubernetes-dashboard, k3s, cloud-provider-aws, zarf, gitlab-kas, prometheus-operator, skaffold, rancher, flux-source-controller, kubernetes, fscrypt, flux-image-automation-controller, flux, external-dns,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: gomplate, kots, pulumi-language-yaml, kyverno, gptscript, guac, podman, osv-scanner, spire-server, pulumi-kubernetes-operator, k9s, kubernetes-dashboard, k3s, cloud-provider-aws, act, gitlab-kas, prometheus-operator, zarf, syft, skaffold, argo-events,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: kots, kyverno, podman, spire-server, kubernetes-dashboard, k3s, cloud-provider-aws, gitlab-kas, docker-cli-buildx, prometheus-operator, rancher, kubernetes, fscrypt, flux, external-dns, aactl, cert-manager, mattermost, zot, helm, loki, containerd,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kots, kyverno, podman, spire-server, kubernetes-dashboard, k3s, cloud-provider-aws, gitlab-kas, docker-cli-buildx, prometheus-operator, rancher, kubernetes, fscrypt, flux, external-dns, aactl, cert-manager, mattermost, zot, helm, loki, containerd,...

BIT-GRAFANA-2026-42127 Pre-authentication denial of service in the public dashboard query endpoint

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

FreeBSD : Gitlab -- Vulnerabilities (ee1e7aef-7117-11f1-873f-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ee1e7aef-7117-11f1-873f-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE Cross-site...

PT-2026-52860

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...

CVE-2026-56761 vulnerabilities

Vulnerabilities for packages: langfuse-fips, kibana, wazuh-dashboard, langfuse, librechat...

GO-2026-5328 Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...