CVE-2025-68428 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips...

CVE-2018-9090

CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials admin/admin for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured b...

CVE-2024-39900

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2025-67255

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability...

Airflow externalLogUrl Permission Bypass

1. Summary The externalLogUrl endpoint in Airflow’s FastAPI enforces only the weaker Task Instance access permission TASKINSTANCE instead of the intended Task Logs permission TASKLOGS. As a result, low-privileged users who are not authorized to view task logs can still obtain external log access...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Java™, IBM® Semeru Runtime and Open-Source Software OSS components used by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary...

OpenSearch Dashboards Unauthorized Access

The vulnerability of the OpenSearch Dashboards component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to data...

CVE-2025-10573: Ivanti EPM Unauthenticated Stored Cross-Site Scripting (Fixed)

Ivanti Endpoint Manager “EPM” versions 2024 SU4 and below are vulnerable to stored cross-site scripting “XSS”. The vulnerability, tracked as CVE-2025-10573 and assigned a CVSS score of 9.6, was patched on December 9, 2025 with the release of Ivanti EPM version EPM 2024 SU4 SR1. An attacker with...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities include several issues, including the ability for low-privileged users to create unauthorized dashboards, access sensitive information via mobile notifications, and the injection of ANSI escape...

CVE-2025-34263 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and...

CVE-2025-34263 Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and...

Advantech WISE-DeviceOn Server cross-site scripting vulnerability

Advantech WISE-DeviceOn Server is Advantech's next-generation unified device management solution based on the WISE-DeviceOn platform. Advantech WISE-DeviceOn Server suffers from a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of user-supplied da...

Splunk Cloud Platform and Splunk Enterprise have vulnerabilities related to input validation errors.

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. An input validation error vulnerability exists...

CVE-2025-12816 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

CVE-2025-66030 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

GHSA-65CH-62R8-G69G vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

CVE-2025-66031 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

GHSA-554W-WPV2-VW27 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

GHSA-5GFM-WPXJ-WJGQ vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, kibana, arangodb, kubeflow-centraldashboard, argo-workflows, kubeflow-katib, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-pipelines, gitlab-rails-ce...

CVE-2025-40890

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be...