21 matches found
CVE-2026-63087
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...
CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...
EUVD-2026-44955
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...
CVE-2026-63087
Grafana OnCall 1.16.11 is affected by an unauthenticated token-hijack vulnerability via the internal plugin install endpoint. An attacker can POST to the endpoint using hardcoded default stack_id and org_id values to obtain a valid PluginAuthToken, which can be used to authenticate against intern...
CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...
PT-2026-60508
Name of the Vulnerable Software and Affected Versions Grafana OnCall versions prior to 1.16.12 Description An unauthenticated access issue exists where remote attackers can obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint. This is possible by using...
EUVD-2024-46730
Malicious code in bioql PyPI...
CVE-2025-4565 vulnerabilities
Vulnerabilities for packages: kserve, grafana-oncall, datadog-agent...
GHSA-8QVM-5X2C-J2W7 vulnerabilities
Vulnerabilities for packages: kserve, grafana-oncall, datadog-agent...
GHSA-8QVM-5X2C-J2W7 vulnerabilities
Vulnerabilities for packages: ghidra, kserve, datadog-agent-fips, datadog-agent, awx, text-generation-inference, request-1276, spamcheck, nemo, grafana-oncall...
CVE-2025-4565 vulnerabilities
Vulnerabilities for packages: ghidra, kserve, datadog-agent-fips, datadog-agent, awx, text-generation-inference, request-1276, spamcheck, nemo, grafana-oncall...
CVE-2025-32873 vulnerabilities
Vulnerabilities for packages: grafana-oncall...
GHSA-8J24-CJRQ-GR2M vulnerabilities
Vulnerabilities for packages: grafana-oncall...
CVE-2024-5526
Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...
The vulnerability of the webhook component of the Grafana OnCall notification system allows a hacker to perform an SSRF attack.
The vulnerability of the webhook component in the Grafana OnCall notification system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...
CVE-2024-5526
Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...
CVE-2024-5526
Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...
CVE-2024-5526
Grafana OnCall CVE-2024-5526 affects versions 1.1.37–1.5.1, with a Server Side Request Forgery (SSRF) vulnerability in the webhook functionality. The issue is resolved in version 1.5.2. Affected component: Grafana OnCall webhook handler. Impact described as SSRF; no explicit exploitation details ...
CVE-2024-5526
Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...
PT-2024-4050 · Grafana · Grafana Oncall
Name of the Vulnerable Software and Affected Versions: Grafana OnCall versions 1.1.37 through 1.5.1 Description: The issue is related to insufficient validation of incoming requests in the webhook functionality of Grafana OnCall, which can allow a remote attacker to perform a Server Side Request...