https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 16:53:31 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110289 <p>A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection&#39;s OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).</p> <p>A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection&#39;s OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).</p> https://db.gcve.eu/vuln/fkie_cve-2026-110289 https://db.gcve.eu/vuln/ghsa-97fx-j86f-w2rp <p>A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection&#39;s OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).</p> <p>A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection&#39;s OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).</p> https://db.gcve.eu/vuln/ghsa-97fx-j86f-w2rp https://db.gcve.eu/vuln/rhsa-2026:93601 <p>grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input follow-redirects: follow-redirects: Information disclosure via cross-origin redirects</p> <p>grafana: GIT SYNC CONNECTIONS COULD SEND CREDENTIALS TO INTERNAL ADDRESSES serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input follow-redirects: follow-redirects: Information disclosure via cross-origin redirects</p> https://db.gcve.eu/vuln/rhsa-2026:93601 https://db.gcve.eu/vuln/wid-sec-w-2026-4568 <p>Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4568