CVE-2025-6197

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.

Prerequisites for exploitation:

- Multiple organizations must exist in the Grafana instance

- Victim must be on a different organization than the one specified in the URL

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jul 18, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-619701.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codCVE-2025-619715.9Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentiaCVE-2025-619728.5Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMCVE-2025-619738.8A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user CVE-2025-619747.5When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  NotCVE-2025-619768.7CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends aCVE-2025-619777.0A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. TheCVE-2025-619797.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-61987.2There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmCVE-2025-619827.8An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpCVE-2025-619838.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-619843.6ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadin
CVE-2025-6197: Medium severity, CVSS 4.2 | Vulnix