34 matches found
SUSE CVE-2026-93294
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...
CVE-2026-93294
The Azure Monitor data source contains a vulnerability where a user with query access can leverage its resource proxy as an unintended proxy. This allows the user to call Azure Resource Manager APIs beyond the scope required by Grafana , performing actions using the data source's Azure identity ....
CVE-2026-110110
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...
CVE-2026-110110
JetLinks Community through version 2.10.0 is vulnerable to a missing authorization flaw (CWE-862) in the AlarmConfigController . Specifically, the _enable and _disable endpoints lack the required save action annotation . This allows users with only query access to toggle alarms by ID, potentially...
CVE-2026-110110: Missing Authorization
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...
CVE-2026-93294: Unintended Proxy or Intermediary
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...
CVE-2026-14538 BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...
PT-2026-66664
Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 0.16.1 through 1.4.0 Description An improper authorization and security-boundary bypass exists in the bigquery-execute-sql tool component. The system uses the BigQuery dry-run API to enforce dataset restrictions;...
CVE-2026-61740
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAGAPIKEY set but AUTHACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULTTOKENSECRET, /auth-status and /login can...
CVE-2026-62147
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces...
EUVD-2010-3611
Malware in sbrugna...
EUVD-2024-2596
Malicious code in bioql PyPI...
EUVD-2021-28814
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-0152
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions...
CVE-2024-6322
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...
PYSEC-2024-298
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information SETTINGSSUPPORT. This is due to inadequate access control for support information...
CVE-2024-8116
An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names...
CVE-2024-52313 data.all authenticated users can obtain incorrect object level authorizations
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all...
BIT-GRAFANA-2024-6322
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...
CVE-2024-6322
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...