878 matches found
CVE-2026-102755
DataEase, an open-source data visualization tool, is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.10.26 . Authenticated users with folder creation permissions can inject HTML-bearing names via the datasource/createFolder or datasetTree/save endpoints. The vulnerability o...
CVE-2026-104141 DataEase: SQL Injection in datasource metadata identifiers
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...
CVE-2026-104141
The open-source data visualization tool DataEase contains a SQL Injection vulnerability in its datasource metadata identifiers. Authenticated users with datasource access can provide crafted schema names, connection usernames, table names, or database names during metadata operations like getSche...
EUVD-2026-101608
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...
CVE-2026-102755: Improper Neutralization of Input During Web Page Generation
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in...
CVE-2026-104141: Improper Neutralization of Special Elements used in an SQL Command
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...
EUVD-2026-94808
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
CVE-2026-71183: Incorrect Authorization
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
GO-2026-6638 Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale
Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale...
afs2-datasource (>=3.6.0, <=3.8.2), amanzi-orca (>=0.5.2, <=0.5.3) +23 more potentially affected by CVE-2026-88029 via pymongo (3.7.2)
pymongo PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - afs2-datasource =3.6.0, =0.5.2, =1.1.0rc1, =0.0.2.dev1, =0.0.4, =0.5.0, =1.0.8a5, =0.2.1, =0.0.1, =0.0.1, =4.0.9, =0.0.3, =0.0.13 and more Source...
Astra Linux – Vulnerability in Jackson-Databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource...
Grafana-CVE-2024-9264
Grafana-CVE-2024-9264 POST /api/ds/query?dstype=expr&expression=true&requestId=Q100 HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Cookie: grafanasession=a739fa9aeb235f2790f17de00fefe528 Content-Length: 368 "from": "1696154400000", "to": "1696345200000", "queries": "datasource":...
CVE-2026-75786
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...
EUVD-2026-90600
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...
AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1780478536)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780478536 advisory. - Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to...
CVE-2026-75786: Improper Neutralization of Special Elements used in an SQL Command
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...
