https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:51:09.449375+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:6420 ALSA-2023:6420 — Moderate: grafana security and enhancement update 2026-10-03T23:51:09.711618+00:00

Affected: AlmaLinux:9: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: persistent xss in grafana core plugins (CVE-2022-23552) * grafana: plugin signature bypass (CVE-2022-31123) * grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130) * grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201) * grafana: email addresses and usernames cannot be trusted (CVE-2022-39306) * grafana: User enumeration via forget password (CVE-2022-39307) * grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324) * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-02621 bdu:2024-02621 2026-10-03T23:51:09.711697+00:00 bdu:2024-02621 https://cve.radiocsirt.org/vuln/bit-grafana-2022-31123 BIT-grafana-2022-31123 — Grafana plugin signature bypass vulnerability 2026-10-03T23:51:09.711721+00:00

Affected: Bitnami: grafana

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-914 certfr-2022-avi-914 — De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contourne… 2026-10-03T23:51:09.711745+00:00 certfr-2022-avi-914 https://cve.radiocsirt.org/vuln/euvd-2026-266776 EUVD-2026-266776 2026-10-03T23:51:09.711761+00:00 EUVD-2026-266776 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31123 fkie_cve-2022-31123 2026-10-03T23:51:09.711772+00:00

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

 https://cve.radiocsirt.org/vuln/ghsa-rhxj-gh46-jvw8 GHSA-rhxj-gh46-jvw8 — Grafana Plugin signature bypass 2026-10-03T23:51:09.711793+00:00

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-31123

We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.

Release 9.2, latest release, also containing security fix:

- [Download Grafana 9.2](https://grafana.com/grafana/download/9.2)

Release 9.1.8, only containing security fix:

- [Download Grafana 9.1.8](https://grafana.com/grafana/download/9.1.8)

Release 8.5.14, only containing security fix:

- [Download Grafana 8.5.14](https://grafana.com/grafana/download/8.5.14)

Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.

## CVE-2022-31123

### Summary On July 4th as a result of an internal security audit we have discovered a bypass in the plugin signature verification by exploiting a versioning flaw.

We believe that this vulnerability is rated at CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).

### Impact An attacker can convince a server admin to download and successfully run a malicious plugin even though [unsigned plugins](https://grafana.com/docs/grafana/latest/administrat…

 https://cve.radiocsirt.org/vuln/gsd-2022-31123 gsd-2022-31123 2026-10-03T23:51:09.711839+00:00 gsd-2022-31123 https://cve.radiocsirt.org/vuln/oesa-2025-1186 OESA-2025-1186 — grafana security update 2026-10-03T23:51:09.711852+00:00

Affected: openEuler:24.03-LTS: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12508-1 openSUSE-SU-2024:12508-1 — grafana-8.5.14-1.1 on GA media 2026-10-03T23:51:09.711903+00:00

grafana-8.5.14-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:3642 RHSA-2023:3642 — Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update 2026-10-03T23:51:09.711922+00:00

ramda: prototype poisoning eventsource: Exposure of Sensitive Information golang: net/http: improper sanitization of Transfer-Encoding header golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters marked: regular expression block.def may lead Denial of Service marked: regular expression inline.reflinkSearch may lead Denial of Service grafana: Use of Cache Containing Sensitive Information golang: encoding/pem: fix stack overflow in Decode Moment.js: Path traversal in moment.locale grafana: An information leak issue was discovered in Grafana through 7.3.4, when integrated with Zabbix golang: net/http: handle server errors after sending GOAWAY golang: encoding/xml: stack exhaustion in Decoder.Skip golang: crypto/elliptic: panic caused by oversized scalar golang: syscall: faccessat checks wrong group golang: crypto/tls: session tickets lack random ticket_age_add golang: io/fs: stack exhaustion in Glob golang: compress/gzip: stack exhaustion in Reader.Read golang: path/filepath: stack exhaustion in Glob golang: encoding/xml: stack exhaustion in Unmarshal golang: encoding/gob: stack exhaustion in Decoder.Decode grafana: stored XSS vulnerability grafana: OAuth account takeover grafana: plugin signature bypass grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat…

 https://cve.radiocsirt.org/vuln/suse-su-2023:0352-1 SUSE-SU-2023:0352-1 — Security update for SUSE Manager Client Tools 2026-10-03T23:51:09.711995+00:00

Security update for SUSE Manager Client Tools

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-31123 UBUNTU-CVE-2022-31123 2026-10-03T23:51:09.712014+00:00

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1702 WID-SEC-W-2022-1702 — Grafana: Mehrere Schwachstellen 2026-10-03T23:51:09.712033+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.