{"kind": "stack", "path": "vulns/stack/applications", "name": "applications", "stack": "applications", "items": [{"id": "CVE-2026-92539", "noindex": false, "published": "2026-10-20T16:55:17.875Z", "modified": "2026-10-20T18:08:00.621Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "severity": "medium", "epss": 0.00337, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-92539", "title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise", "description": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.", "references": ["https://grafana.com/security/security-advisories/cve-2026-92539", "https://nvd.nist.gov/vuln/detail/CVE-2026-92539"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-9703", "noindex": false, "published": "2026-10-15T14:02:00.146Z", "modified": "2026-10-16T18:52:39.623Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00195, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-9703", "title": "Viewer role can create, modify and delete Loki alerting rules", "description": "Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other p", "references": ["https://grafana.com/security/security-advisories/cve-2026-9703", "https://nvd.nist.gov/vuln/detail/CVE-2026-9703"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}, {"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-33374", "noindex": false, "published": "2026-10-13T17:05:49.782Z", "modified": "2026-10-13T19:21:25.512Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33374", "title": "Unbounded memory allocation in the Prometheus rule conversion API", "description": "The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33374", "https://nvd.nist.gov/vuln/detail/CVE-2026-33374"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}, {"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-15577", "noindex": false, "published": "2026-10-13T17:05:49.743Z", "modified": "2026-10-13T19:31:30.110Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-15577", "title": "Git Sync connection configuration can be modified with read-only access", "description": "A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.", "references": ["https://grafana.com/security/security-advisories/cve-2026-15577", "https://nvd.nist.gov/vuln/detail/CVE-2026-15577"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-93294", "noindex": false, "published": "2026-10-13T17:05:49.715Z", "modified": "2026-10-13T19:31:30.245Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00267, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-93294", "title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs", "description": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.", "references": ["https://grafana.com/security/security-advisories/cve-2026-93294", "https://nvd.nist.gov/vuln/detail/CVE-2026-93294"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-95502", "noindex": false, "published": "2026-10-13T17:05:49.670Z", "modified": "2026-10-13T19:31:30.373Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-95502", "title": "Git Sync memory exhaustion via a malicious Git server", "description": "A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.", "references": ["https://grafana.com/security/security-advisories/cve-2026-95502", "https://nvd.nist.gov/vuln/detail/CVE-2026-95502"], "fixes": ["1.7.0", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "nanogit", "path": "vulns/nanogit", "ecosystem": ""}, {"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-59788", "noindex": false, "published": "2026-10-05T10:29:43.438Z", "modified": "2026-10-05T11:23:05.997Z", "cvss": 5.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00251, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59788", "title": "Stored XSS vulnerability in OAuth configuration form", "description": "The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.", "references": ["https://support.zabbix.com/browse/ZBX-28198", "https://nvd.nist.gov/vuln/detail/CVE-2026-59788"], "fixes": ["7.4.12"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-59787", "noindex": false, "published": "2026-10-05T10:29:20.302Z", "modified": "2026-10-05T11:23:32.622Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00226, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59787", "title": "SNMP trap injection in zabbix_trap_receiver.pl", "description": "The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.", "references": ["https://support.zabbix.com/browse/ZBX-28197", "https://nvd.nist.gov/vuln/detail/CVE-2026-59787"], "fixes": ["1:7.0.29+dfsg-1", "6.0.48", "7.0.29", "7.4.13"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-59786", "noindex": false, "published": "2026-10-05T10:29:01.810Z", "modified": "2026-10-05T11:25:27.518Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00203, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59786", "title": "Active agent heartbeat missing TLS check", "description": "Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.", "references": ["https://support.zabbix.com/browse/ZBX-28196", "https://nvd.nist.gov/vuln/detail/CVE-2026-59786"], "fixes": ["1:7.0.29+dfsg-1", "7.0.29", "7.4.13"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-59785", "noindex": false, "published": "2026-10-05T10:28:30.248Z", "modified": "2026-10-05T11:43:32.737Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00158, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59785", "title": "Hidden host credentials inferable via multiselect.get filtering", "description": "Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.", "references": ["https://support.zabbix.com/browse/ZBX-28195", "https://nvd.nist.gov/vuln/detail/CVE-2026-59785"], "fixes": ["1:7.0.29+dfsg-1", "6.0.48", "7.0.29", "7.4.13"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-59783", "noindex": false, "published": "2026-10-05T10:28:09.917Z", "modified": "2026-10-05T11:50:08.690Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00226, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59783", "title": "Server DoS via binary items", "description": "The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.", "references": ["https://support.zabbix.com/browse/ZBX-28194", "https://nvd.nist.gov/vuln/detail/CVE-2026-59783"], "fixes": ["1:7.0.29+dfsg-1", "7.0.29", "7.4.13"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-59782", "noindex": false, "published": "2026-10-05T10:27:34.672Z", "modified": "2026-10-05T11:53:36.626Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-59782", "title": "JavaScript preprocessing memory disclosure", "description": "The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.", "references": ["https://support.zabbix.com/browse/ZBX-28193", "https://nvd.nist.gov/vuln/detail/CVE-2026-59782"], "fixes": ["1:7.0.29+dfsg-1", "6.0.48", "7.0.29", "7.4.13"], "products": [{"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}]}, {"id": "CVE-2026-13720", "noindex": false, "published": "2026-09-30T11:06:38.177Z", "modified": "2026-09-30T15:28:07.969Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-13720", "title": "Editor can forge file-provisioning provenance on dashboards via the dashboard API", "description": "An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-13720", "https://nvd.nist.gov/vuln/detail/CVE-2026-13720"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-13719", "noindex": false, "published": "2026-09-30T11:06:38.172Z", "modified": "2026-09-30T14:29:13.891Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00301, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-13719", "title": "Alert rules in restricted folders disclosed via the alert rules list API", "description": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-13719", "https://nvd.nist.gov/vuln/detail/CVE-2026-13719"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-81842", "noindex": false, "published": "2026-09-29T20:50:01.257Z", "modified": "2026-09-30T15:28:16.203Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-81842", "title": "Library panel can be moved into a folder without library panel create permission", "description": "An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-81842", "https://nvd.nist.gov/vuln/detail/CVE-2026-81842"], "fixes": ["12.4.12", "13.0.10"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-81841", "noindex": false, "published": "2026-09-29T20:35:57.152Z", "modified": "2026-09-30T13:05:14.107Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-81841", "title": "Paused shared dashboard access tokens still expose data source configuration", "description": "Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.", "references": ["https://grafana.com/security/security-advisories/cve-2026-81841", "https://nvd.nist.gov/vuln/detail/CVE-2026-81841"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-77621", "noindex": false, "published": "2026-09-22T15:19:19.526Z", "modified": "2026-09-25T23:32:37.447Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.01124, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77621", "title": "Vector: Arbitrary file write in the file sink via templated path (path traversal).", "description": "Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed sc", "references": ["https://github.com/vectordotdev/vector/security/advisories/GHSA-6342-xwvw-c637", "https://github.com/vectordotdev/vector/pull/25820", "https://github.com/vectordotdev/vector/pull/25830"], "fixes": [], "products": [{"name": "vector", "path": "vulns/vector", "ecosystem": ""}]}, {"id": "CVE-2026-77620", "noindex": false, "published": "2026-09-22T15:18:21.102Z", "modified": "2026-09-22T15:41:12.948Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00524, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77620", "title": "Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).", "description": "Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.", "references": ["https://github.com/vectordotdev/vector/security/advisories/GHSA-qp6f-fpfx-4gg6", "https://github.com/vectordotdev/vector/pull/25825", "https://github.com/vectordotdev/vector/commit/57fed991083c9a43d5fda2d5b3bf4718aedf6526"], "fixes": [], "products": [{"name": "vector", "path": "vulns/vector", "ecosystem": ""}]}, {"id": "CVE-2026-77619", "noindex": false, "published": "2026-09-22T15:15:45.066Z", "modified": "2026-09-22T16:06:54.582Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00524, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77619", "title": "Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.", "description": "Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeli", "references": ["https://github.com/vectordotdev/vector/security/advisories/GHSA-rrfg-9487-mhp6", "https://github.com/vectordotdev/vector/pull/25819", "https://github.com/vectordotdev/vector/commit/3162ed1a2e5e8d3f210134607518a26aa01e1a37"], "fixes": [], "products": [{"name": "vector", "path": "vulns/vector", "ecosystem": ""}]}, {"id": "CVE-2026-77165", "noindex": false, "published": "2026-09-21T15:25:33.553Z", "modified": "2026-09-21T18:44:22.324Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-77165", "title": "CVE-2026-77165", "description": "File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.", "references": ["https://hackerone.com/reports/3770482", "https://nvd.nist.gov/vuln/detail/CVE-2026-77165"], "fixes": [], "products": [{"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}]}], "total": 324, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 17, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}, {"name": "grafana", "path": "vulns/ubuntu-16.04-lts/grafana", "ecosystem": "Ubuntu:16.04:LTS"}, {"name": "nanogit", "path": "vulns/nanogit", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/zabbix", "ecosystem": ""}, {"name": "zabbix", "path": "vulns/ubuntu-pro-14.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:14.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-16.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:16.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-18.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:18.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-20.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:20.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-pro-22.04-lts/zabbix", "ecosystem": "Ubuntu:Pro:22.04:LTS"}, {"name": "zabbix", "path": "vulns/ubuntu-26.10/zabbix", "ecosystem": "Ubuntu:26.10"}, {"name": "zabbix", "path": "vulns/ubuntu-26.04-lts/zabbix", "ecosystem": "Ubuntu:26.04:LTS"}, {"name": "zabbix", "path": "vulns/debian-12/zabbix", "ecosystem": "Debian:12"}, {"name": "zabbix", "path": "vulns/debian-13/zabbix", "ecosystem": "Debian:13"}, {"name": "zabbix", "path": "vulns/debian-14/zabbix", "ecosystem": "Debian:14"}, {"name": "vector", "path": "vulns/vector", "ecosystem": ""}, {"name": "nextcloud", "path": "vulns/nextcloud", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 16, "kev": 0}, "lastmod": "2026-10-20T18:08:00.621Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}