| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. |
| A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled. |
| The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions. |
| Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0. |
| Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0. |
| Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0. |
| youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access. |
| Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
| Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
| Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. |
| Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network. |
