CVE-2026-11769

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials through the TokenReview API and PolicyBinding resource. An attacker can escalate privileges and potentially access sensitive data by exploiting the improper validation of service account tokens and...

CVE-2024-47070

CVE-2024-47070 affects authentik (open-source identity provider) versions prior to 2024.8.3 and 2024.6.5. An authentication bypass exists when an attacker-supplied X-Forwarded-For header contains an unparsable value (e.g., a), which can bypass the password stage due to a policy binding flaw and a...