Metasploit adds Langflow, OpenCTI, Grafana and MongoDB modules
Six Langflow modules cover an auth bypass and remote code execution from 1.0.0 through 1.11.4.
66
Product
Grafana
- Mentions · 7d0
- Mentions · 30d4
- All mentions7
- First seenAug 17, 2026
- Last mentioned7d ago
Timeline
7 articles · newest firstClarify Grafana CVE-2024-9264 version handling
A Metasploit commit clarifies version handling for the Grafana CVE-2024-9264 module.
18
Claude can now generate animated explainer videos and live data dashboards from text prompts
Anthropic launched Claude Dashboards and Motion betas that turn prompts into live dashboards and animated videos.
58
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
Gentlemen ransomware affiliate Azazel used Model Context Protocol as live command-and-control across victims in six countries.
78
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek V4.1 Flash achieves 11/11 code executions on Enclave's AI hacking benchmark for $4.65 across Grafana, Jenkins, and Nextcloud targets.
60
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
48
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
45
Related CVEs
by mentions- CVE-2024-926495%9.4Authenticated Command Injection & Local File Inclusion in Grafana SQL Expressions
- CVE-2023-3287<1%8.8A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system
- CVE-2023-3288<1%8.8A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system
- CVE-2023-38054<1%8.1A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
- CVE-2023-38050<1%8.1A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)
- CVE-2023-38051<1%8.1A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)
- CVE-2023-3285<1%7.7A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin)
- CVE-2024-1313<1%6.5It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to…
- CVE-2023-3289<1%6.5A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
- CVE-2023-3290<1%5.0A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system
Appears with
- Palo Alto Networksorganization · 2
- Easy!Appointmentsproduct · 2
- Unit 42organization · 2
- Unit 42threat actor · 2
- Rapid7organization · 2
- Grafanavendor · 2
- Palo Alto Networksvendor · 2
- GitLabproduct · 1
- Databricksproduct · 1
- Jenkinsproduct · 1
- 4gaBoardsproduct · 1
- MongoDBproduct · 1
- Apache Solrproduct · 1
- Salesforceproduct · 1
- BigQueryproduct · 1
- Easy!Appointmentsvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.