https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 06:59:31 +0000 https://vulnerability.circl.lu/vuln/bdu:2026-12021 bdu:2026-12021 https://vulnerability.circl.lu/vuln/bdu:2026-12021 https://vulnerability.circl.lu/vuln/bit-grafana-2026-28378 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> https://vulnerability.circl.lu/vuln/bit-grafana-2026-28378 https://vulnerability.circl.lu/vuln/fkie_cve-2026-28378 <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-28378 https://vulnerability.circl.lu/vuln/ghsa-x94r-qqxh-wpj5 <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> <p>The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard&#39;s identifiers.</p> https://vulnerability.circl.lu/vuln/ghsa-x94r-qqxh-wpj5 https://vulnerability.circl.lu/vuln/rhsa-2026:66008 <p>grafana: Grafana: Session takeover via Auth Proxy cache key collision undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: HTTP response splitting via retry interceptor undici: undici: Denial of Service via unrequested WebSocket subprotocol grafana: Grafana: Unauthorized public dashboard deletion across organizations undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close</p> <p>grafana: Grafana: Session takeover via Auth Proxy cache key collision undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: HTTP response splitting via retry interceptor undici: undici: Denial of Service via unrequested WebSocket subprotocol grafana: Grafana: Unauthorized public dashboard deletion across organizations undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close</p> https://vulnerability.circl.lu/vuln/rhsa-2026:66008