CVE-2026-25755 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

GHSA-9VJF-QC39-JPRP vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

GHSA-P5XG-68WR-HM3M vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

CVE-2026-25940 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

GHSA-67PG-WM7F-Q7FJ vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

GHSA-GQ3J-XVXP-8HRF vulnerabilities

Vulnerabilities for packages: langfuse...

grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions ...

BIT-GRAFANA-2026-21722 Public Dashboards time range restriction on annotations can be bypassed

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions ...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 grafana/grafana/pkg/services/dashboards: Grafana...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-848J-6MX2-7J84 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-848J-6MX2-7J84 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, librechat, opensearch-dashboards...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, librechat, opensearch-dashboards...

GHSA-43FC-JF86-J433 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, opensearch-dashboards, kubeflow-centraldashboard, saf, prism, nextcloud-server, jitsucom-jitsu, langfuse, lerna...

CVE-2026-25639 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, opensearch-dashboards, kubeflow-centraldashboard, saf, prism, nextcloud-server, jitsucom-jitsu, langfuse, lerna...

SUSE CVE-2026-21722

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any...

CVE-2026-25536 vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-345P-7CG4-V4C7 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-21722

A flaw was found in Grafana. Public dashboards with annotations enabled fail to limit their annotation time range to the locked time range of the public dashboard. This flaw allows an attacker to retrieve the entire history of annotations visible on that dashboard, including those outside the...