- CVE-2026-21722: clamp public dashboard annotation queries to the dashboard's locked time range when time selection is disabled - CVE-2026-10601: reject Loki resource paths that escape /loki/api/v1/ and require Tempo trace ids to be hexadecimal - CVE-2026-28380: resolve the snapshot's dashboard by uid so the delete permission check is not skipped - CVE-2024-10452: require a matching org (or server admin) to revoke an invite - CVE-2026-28379: take the read lock around the managed-stream map lookup to stop a fatal concurrent map read/write crash - CVE-2026-28376: bound the Live push request body at 500k - CVE-2026-28383: bound the plugin resource request body at 128 MiB - CVE-2026-28375: cap testdata scenario data points at 10000 - CVE-2026-27879: bound the mathexp.Resample upsample length