https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T16:53:31.376247+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-106472 fkie_cve-2026-106472 2026-11-14T16:53:31.378292+00:00

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.

 https://db.gcve.eu/vuln/ghsa-fm3v-fvpq-jvxg GHSA-fm3v-fvpq-jvxg 2026-11-14T16:53:31.378349+00:00

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.

 https://db.gcve.eu/vuln/msrc_cve-2026-106472 msrc_CVE-2026-106472 — Server-side request forgery in the Prometheus data source resource API 2026-11-14T16:53:31.378369+00:00 msrc_CVE-2026-106472 https://db.gcve.eu/vuln/wid-sec-w-2026-4568 WID-SEC-W-2026-4568 — Grafana: Mehrere Schwachstellen 2026-11-14T16:53:31.378388+00:00

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.