TI-2026-74664 CVE-2026-100353 · GHSA-vrcc-3ch7-hppw
Nil pointer panic in kin-openapi openapi3filter decoding
Priority HIGH 72
kin-openapi is a Go project for handling OpenAPI files.
RHSA-2026:91292
Red Hat Hardened Images RPMs Security Update
Released 2026-10-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images grafana12.4-12.4.13-0.5.hum1@aarch64, grafana12.4-12.4.13-0.5.hum1@src, grafana12.4-12.4.13-0.5.hum1@x86_64
Fixes 10 records
TI-2026-74663 CVE-2026-100352 · GHSA-rj39-cv6w-8wv7
YAML NaN and Inf values cause panic in kin-openapi validation
Priority HIGH 72
kin-openapi is a Go project for handling OpenAPI files.
TI-2026-74657 CVE-2026-100354 · GHSA-g8cf-rcjf-c8cf
Uncontrolled recursion in kin-openapi crashes the process
Priority HIGH 72
kin-openapi is a Go project for handling OpenAPI files.
TI-2026-82043 CVE-2026-103506 · GHSA-qr52-42rj-4mw4
Missing authorization in Grafana SSO settings exposes client secrets
Priority MEDIUM 40
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization).
TI-2026-79287 CVE-2026-111181 · GHSA-27r3-jxmh-p828
Crash in body-parser via trailing bytes after compressed request body
Priority LOW 39
body-parser is body parsing middleware for Node.js and Express.
TI-2026-76744 CVE-2026-110306 · GHSA-w74x-v6f9-j3xg
URI scheme spoofing in fast-uri via percent-encoded scheme decoding
Priority LOW 27
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
TI-2026-82091 CVE-2026-79656 · GHSA-jgwg-2rm4-8mgf
Grafana OAuth connectors write unredacted tokens to server logs
Priority LOW 26
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab provi…
TI-2026-76743 CVE-2026-110180 · GHSA-wjr9-j795-jxcr
Host confusion in fast-uri from unchecked host canonicalization
Priority LOW 22
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
TI-2026-76745 CVE-2026-110725 · GHSA-333x-w4r6-6crp
Scheme injection in fast-uri via unescaped colon in suffix references
Priority LOW 17
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.
TI-2026-76742 CVE-2026-110095 · GHSA-xhq7-xmqj-769h
Improper path resolution in fast-uri relative reference normalization
Priority LOW 17
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js.