CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-57920

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/orgId endpoints...

CVE-2026-56235 Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions getappmetrics, getglobalmetrics, gettotalmetrics that are granted to the anon role without enforcing org membership or permission checks. An unauthenticated attacker using only the public...

Chanjet CRM SQL injection vulnerability

Chanjet CRM is a customer relationship management system developed by Chanjet Corporation. Version 1.0 of Chanjet CRM has a SQL injection vulnerability. This vulnerability stems from incorrect handling of the parameter gblOrgID in the HTTP GET Request Handler component...

SUSE CVE-2026-21727

A cross-tenant isolation vulnerability was found in Grafana's Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing orgid = 0 records to be returned across organizations, a user with datasource management privileges could read and permanentl...

CVE-2025-59686: Improper Authorization

Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...

PT-2025-3162

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.14.1 Description A vulnerability in the user management endpoint /api/org id/users/email id allows an "Admin" role user to remove a "Root" user from the organization, violating the intended privilege hierarchy...

CVE-2024-5478

A Cross-site Scripting XSS vulnerability exists in the SAML metadata endpoint "/auth/saml/$org?.id/metadata" of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the "orgId" parameter supplied by the user before incorporating it into t...

PT-2024-36418 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.7 Description: A Cross-site Scripting XSS issue exists due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the generated response. The...

CVE-2024-4254

The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code from a fork, which is unsafe as it...

PT-2024-20597

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.8.0 Description A vulnerability has been identified in the "/api/org id/users" endpoint, allowing any authenticated regular user to add new users with elevated privileges, including the 'root' role, to an...

PT-2022-21200

Name of the Vulnerable Software and Affected Versions Grafana version 8.4.3 Description The issue allows unauthenticated access via a "/dashboard/snapshot/?orgId=0" URI. The vendor considers this a UI bug, not a vulnerability. Recommendations For Grafana version 8.4.3, consider restricting access...

How to allocate Citrix licenses on My Account

This article describes how to allocate a Citrix Licenses on a Citrix portal Note: If a customer calls regarding cloud license allocation, inquire whether they are trying to allocate licenses between multi-tenants within the same Org ID or transfer licenses from one Org ID to another. If they are...