Perses
by Perses
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-63445 | hig | 0.38 | — | — | Sep 18, 2026 | ### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies,… | ||
| CVE-2026-63199 | hig | 0.38 | — | — | Sep 18, 2026 | ### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant… | ||
| CVE-2026-63458 | hig | 0.38 | — | — | Sep 18, 2026 | ### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the… |
- risk 0.38cvss —epss —
### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource `Query` struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies,…
- risk 0.38cvss —epss —
### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant…
- risk 0.38cvss —epss —
### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the…