{"kind": "product", "path": "vulns/grafana", "name": "grafana", "product": "grafana", "items": [{"id": "CVE-2026-92539", "noindex": false, "published": "2026-10-20T16:55:17.875Z", "modified": "2026-10-20T18:08:00.621Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "severity": "medium", "epss": 0.00338, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-92539", "title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise", "description": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.", "references": ["https://grafana.com/security/security-advisories/cve-2026-92539", "https://nvd.nist.gov/vuln/detail/CVE-2026-92539"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-9703", "noindex": false, "published": "2026-10-15T14:02:00.146Z", "modified": "2026-10-16T18:52:39.623Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00195, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-9703", "title": "Viewer role can create, modify and delete Loki alerting rules", "description": "Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.\n\nExploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other p", "references": ["https://grafana.com/security/security-advisories/cve-2026-9703", "https://nvd.nist.gov/vuln/detail/CVE-2026-9703"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}, {"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-33374", "noindex": false, "published": "2026-10-13T17:05:49.782Z", "modified": "2026-10-13T19:21:25.512Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00368, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-33374", "title": "Unbounded memory allocation in the Prometheus rule conversion API", "description": "The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.", "references": ["https://grafana.com/security/security-advisories/cve-2026-33374", "https://nvd.nist.gov/vuln/detail/CVE-2026-33374"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-15577", "noindex": false, "published": "2026-10-13T17:05:49.743Z", "modified": "2026-10-13T19:31:30.110Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-15577", "title": "Git Sync connection configuration can be modified with read-only access", "description": "A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.", "references": ["https://grafana.com/security/security-advisories/cve-2026-15577", "https://nvd.nist.gov/vuln/detail/CVE-2026-15577"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-93294", "noindex": false, "published": "2026-10-13T17:05:49.715Z", "modified": "2026-10-13T19:31:30.245Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00267, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-93294", "title": "Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs", "description": "A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.", "references": ["https://grafana.com/security/security-advisories/cve-2026-93294", "https://nvd.nist.gov/vuln/detail/CVE-2026-93294"], "fixes": ["12.4.13", "13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-95502", "noindex": false, "published": "2026-10-13T17:05:49.670Z", "modified": "2026-10-13T19:31:30.373Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-95502", "title": "Git Sync memory exhaustion via a malicious Git server", "description": "A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.", "references": ["https://grafana.com/security/security-advisories/cve-2026-95502", "https://nvd.nist.gov/vuln/detail/CVE-2026-95502"], "fixes": ["13.0.11", "13.1.8", "13.2.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-13720", "noindex": false, "published": "2026-09-30T11:06:38.177Z", "modified": "2026-09-30T15:28:07.969Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-13720", "title": "Editor can forge file-provisioning provenance on dashboards via the dashboard API", "description": "An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-13720", "https://nvd.nist.gov/vuln/detail/CVE-2026-13720"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-13719", "noindex": false, "published": "2026-09-30T11:06:38.172Z", "modified": "2026-09-30T14:29:13.891Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00239, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-13719", "title": "Alert rules in restricted folders disclosed via the alert rules list API", "description": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-13719", "https://nvd.nist.gov/vuln/detail/CVE-2026-13719"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-81842", "noindex": false, "published": "2026-09-29T20:50:01.257Z", "modified": "2026-09-30T15:28:16.203Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-81842", "title": "Library panel can be moved into a folder without library panel create permission", "description": "An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.", "references": ["https://grafana.com/security/security-advisories/cve-2026-81842", "https://nvd.nist.gov/vuln/detail/CVE-2026-81842"], "fixes": ["12.4.12", "13.0.10"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-81841", "noindex": false, "published": "2026-09-29T20:35:57.152Z", "modified": "2026-09-30T13:05:14.107Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-81841", "title": "Paused shared dashboard access tokens still expose data source configuration", "description": "Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.", "references": ["https://grafana.com/security/security-advisories/cve-2026-81841", "https://nvd.nist.gov/vuln/detail/CVE-2026-81841"], "fixes": ["12.4.12", "13.0.10", "13.1.7", "13.2.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-15815", "noindex": false, "published": "2026-09-17T20:47:01.006Z", "modified": "2026-09-19T03:56:26.777Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00685, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-15815", "title": "CVE-2026-15815 CVE Record", "description": "Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when\nextracting plugin archives. A crafted plugin archive can chain relative symbolic link\nentries to escape the plugin installation directory, writing arbitrary files and an\nexecutable backend binary outside that directory. The dropped executable runs with the\nprivileges of the Grafana server process, resulting in remote code execution.\n\nPlugin archives are extracted before their signature is verified, so a valid plugin\nsignature does not prevent the write. An operator can therefore be affected by\ninstalling a plugin that appears legitimate, as well as by installing a p", "references": ["https://grafana.com/security/security-advisories/cve-2026-15815", "https://nvd.nist.gov/vuln/detail/CVE-2026-15815"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-76154", "noindex": false, "published": "2026-09-17T20:22:55.718Z", "modified": "2026-10-14T10:12:30.371Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-76154", "title": "CVE-2026-76154 CVE Record", "description": "A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.", "references": ["https://grafana.com/security/security-advisories/cve-2026-76154", "https://nvd.nist.gov/vuln/detail/CVE-2026-76154"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-14199", "noindex": false, "published": "2026-09-02T16:06:28.165Z", "modified": "2026-09-03T08:07:46.925Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00325, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-14199", "title": "Session takeover via Auth Proxy cache key collision", "description": "Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).", "references": ["https://grafana.com/security/security-advisories/cve-2026-14199", "https://nvd.nist.gov/vuln/detail/CVE-2026-14199"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-12704", "noindex": false, "published": "2026-09-02T16:05:42.965Z", "modified": "2026-09-03T08:07:34.086Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00291, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-12704", "title": "SAML assertion replay via skipped InResponseTo validation", "description": "When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.", "references": ["https://grafana.com/security/security-advisories/cve-2026-12704", "https://nvd.nist.gov/vuln/detail/CVE-2026-12704"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-19475", "noindex": false, "published": "2026-09-02T15:56:33.568Z", "modified": "2026-09-03T08:08:02.649Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00417, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-19475", "title": "SQL Data Source Plugin: OOM DoS via $__timeGroup macro", "description": "An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.", "references": ["https://grafana.com/security/security-advisories/cve-2026-19475", "https://nvd.nist.gov/vuln/detail/CVE-2026-19475"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-19197", "noindex": false, "published": "2026-08-26T08:50:27.854Z", "modified": "2026-08-27T17:22:36.904Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-19197", "title": "Broken access control in dashboard snapshots", "description": "A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).", "references": ["https://grafana.com/security/security-advisories/cve-2026-19197", "https://nvd.nist.gov/vuln/detail/CVE-2026-19197"], "fixes": ["12.4.8", "13.0.6", "13.1.3"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-17033", "noindex": false, "published": "2026-08-24T13:52:26.910Z", "modified": "2026-08-27T17:22:43.827Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L", "severity": "medium", "epss": 0.00218, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-17033", "title": "CVE-2026-17033 CVE Record", "description": "An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.\n\nGrafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with th", "references": ["https://grafana.com/security/security-advisories/cve-2026-17033", "https://nvd.nist.gov/vuln/detail/CVE-2026-17033"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-17183", "noindex": false, "published": "2026-08-19T17:30:06.798Z", "modified": "2026-08-27T17:22:31.524Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-17183", "title": "CVE-2026-17183 CVE Record", "description": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials to users who lack permission to query that datasource.", "references": ["https://grafana.com/security/security-advisories/cve-2026-17183", "https://nvd.nist.gov/vuln/detail/CVE-2026-17183"], "fixes": ["12.3.11", "12.4.9", "13.0.7", "13.1.4"], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-11817", "noindex": false, "published": "2026-08-17T21:28:17.497Z", "modified": "2026-09-14T10:16:35.588Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-11817", "title": "CVE-2026-11817 CVE Record", "description": "This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a ", "references": ["https://grafana.com/security/security-advisories/cve-2026-11817", "https://nvd.nist.gov/vuln/detail/CVE-2026-11817"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}, {"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}, {"id": "CVE-2026-21723", "noindex": false, "published": "2026-07-23T01:48:16.245Z", "modified": "2026-08-27T17:22:29.672Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00215, "kev": false, "exploits": [], "stacks": [{"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "path": "vulns/cve-2026-21723", "title": "CVE-2026-21723 Record", "description": "The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.", "references": ["https://grafana.com/security/security-advisories/cve-2026-21723", "https://nvd.nist.gov/vuln/detail/CVE-2026-21723"], "fixes": [], "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}]}], "total": 100, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "grafana", "path": "vulns/grafana", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["13.2.3", "13.2.0", "13.1.7", "13.1.4", "13.1.3", "13.1.0", "13.0.10", "13.0.7", "13.0.6", "13.0.1", "13.0.0", "12.4.12"], "stats": {"recent": 10, "kev": 0}, "lastmod": "2026-10-20T18:08:00.621Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}