Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_10226)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202610226 advisory. grafana: Grafana: Information disclosure of data-source passwords via public dashboards CVE-2026-27877 Tenable has extracted the preceding description block direct...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards...

CVE-2026-56762 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, opensearch-dashboards, kibana, librechat, gemini-cli, opensearch-dashboards-fips...

GHSA-55CM-P4WW-685G vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, opensearch-dashboards, kibana, librechat, gemini-cli, opensearch-dashboards-fips...

CVE-2026-53610 GLPI: Reflected XSS in dashboards

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

CVE-2026-53610 GLPI: Reflected XSS in dashboards

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

CVE-2026-53610 GLPI: Reflected XSS in dashboards

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or ...

GHSA-M9C2-85GV-8XR5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or ...

Missing Authorization

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Missing Authorization through the update flow in ViewsResource for saved searches and dashboards. An attacker can gain owner-level control over a view by sending an update reque...

CVE-2026-69190 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

PT-2026-96190

Name of the Vulnerable Software and Affected Versions Graylog versions 6.3.0 through 6.3.13 Graylog versions 7.0.x prior to 7.0.9 Graylog versions 7.1.x prior to 7.1.4 Description The view update API for saved searches and dashboards allows a user with edit permissions, who is not the entity owne...

CLEANSTART-2026-VD64269 Security fix for GHSA-qffp-2rhf-9h96 applied in: mongosh 2.5.10-r5, mongosh 2.8.1-r0, npm 11.11.0-r1, opensearch-dashboards-fips 3.5.0-r1, renovate 43.4.3-r1, renovate 43.4.4-r0, sqlpad 7.5.7-r1

GHSA-qffp-2rhf-9h96 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BV94239 Security fix for GHSA-w7fw-mjwx-w883 applied in: opensearch-dashboards-fips 3.5.0-r1, renovate 43.4.3-r1, renovate 43.4.4-r0

GHSA-w7fw-mjwx-w883 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VM51396 Security fix for GHSA-2g4f-4pwh-qvx6 applied in: opensearch-dashboards-fips 2.19.5-r0, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

GHSA-2g4f-4pwh-qvx6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LT23543 Security fix for GHSA-23c5-xmqv-rm74 applied in: argo-workflows 3.7.17-r1, mongosh 2.5.10-r3, mongosh 2.6.0-r2, mongosh 2.7.0-r0, opensearch-dashboards-fips 3.5.0-r2, renovate 43.4.3-r1, renovate 43.4.4-r0

GHSA-23c5-xmqv-rm74 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DN87303 Security fix for GHSA-8gc5-j5rx-235r applied in: kibana 9.3.2-r3, mongosh 2.8.1-r0, opensearch-dashboards-fips 3.5.0-r1, renovate 43.4.3-r1, renovate 43.4.4-r0

GHSA-8gc5-j5rx-235r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XI72782 Security fix for GHSA-37qj-frw5-hhjh applied in: opensearch-dashboards-fips 3.5.0-r1, renovate 43.4.3-r1, renovate 43.4.4-r0

GHSA-37qj-frw5-hhjh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...