https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 13:35:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-103506 <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> https://db.gcve.eu/vuln/fkie_cve-2026-103506 https://db.gcve.eu/vuln/ghsa-qr52-42rj-4mw4 <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> https://db.gcve.eu/vuln/ghsa-qr52-42rj-4mw4 https://db.gcve.eu/vuln/rhsa-2026:91181 <p>grafana: OAuth and OIDC tokens written unredacted to Grafana server logs grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled fast-uri: fast-uri: Path traversal via improper relative URI normalization fast-uri: fast-uri: Security policy bypass via improper host canonicalization fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths body-parser: body-parser: Denial of Service via unhandled decompression stream error</p> <p>grafana: OAuth and OIDC tokens written unredacted to Grafana server logs grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled fast-uri: fast-uri: Path traversal via improper relative URI normalization fast-uri: fast-uri: Security policy bypass via improper host canonicalization fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths body-parser: body-parser: Denial of Service via unhandled decompression stream error</p> https://db.gcve.eu/vuln/rhsa-2026:91181 https://db.gcve.eu/vuln/ubuntu-cve-2026-103506 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-103506