https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:22:42.112426+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:2167 ALSA-2023:2167 — Moderate: grafana security and enhancement update 2026-10-03T01:22:42.134427+00:00

Affected: AlmaLinux:9: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957) * grafana: using email as a username can block other users from signing in (CVE-2022-39229) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-02618 bdu:2024-02618 2026-10-03T01:22:42.134498+00:00 bdu:2024-02618 https://cve.radiocsirt.org/vuln/bit-grafana-2022-39229 BIT-grafana-2022-39229 — Grafana users with email as a username can block other users from signing in 2026-10-03T01:22:42.134516+00:00

Affected: Bitnami: grafana

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-914 certfr-2022-avi-914 — De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contourne… 2026-10-03T01:22:42.134548+00:00 certfr-2022-avi-914 https://cve.radiocsirt.org/vuln/cnvd-2022-87932 cnvd-2022-87932 2026-10-03T01:22:42.134564+00:00 cnvd-2022-87932 https://cve.radiocsirt.org/vuln/euvd-2026-233524 EUVD-2026-233524 2026-10-03T01:22:42.134584+00:00 EUVD-2026-233524 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39229 fkie_cve-2022-39229 2026-10-03T01:22:42.134595+00:00

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-gj7m-853r-289r GHSA-gj7m-853r-289r — Grafana when using email as a username can block other users from signing in 2026-10-03T01:22:42.134625+00:00

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229

We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.

Release 9.2, latest release, also containing security fix:

- [Download Grafana 9.2](https://grafana.com/grafana/download/9.2)

Release 9.1.8, only containing security fix:

- [Download Grafana 9.1.8](https://grafana.com/grafana/download/9.1.8)

Release 8.5.14, only containing security fix:

- [Download Grafana 8.5.14](https://grafana.com/grafana/download/8.5.14)

Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.

## Improper authentication - CVE-2022-39229

### Summary

On September 7 as a result of an internal security audit we have discovered a security vulnerability in Grafana basic authentication, related to the usage of username and email address.

In Grafana, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user.

In addition, a user can have an email address as a username and Grafana…

 https://cve.radiocsirt.org/vuln/gsd-2022-39229 gsd-2022-39229 2026-10-03T01:22:42.134679+00:00 gsd-2022-39229 https://cve.radiocsirt.org/vuln/oesa-2024-2260 OESA-2024-2260 — grafana security update 2026-10-03T01:22:42.134691+00:00

Affected: openEuler:22.03-LTS-SP1: grafana, openEuler:24.03-LTS: grafana, openEuler:22.03-LTS-SP4: grafana, openEuler:22.03-LTS-SP3: grafana, openEuler:20.03-LTS-SP4: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.(CVE-2022-39229)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12508-1 openSUSE-SU-2024:12508-1 — grafana-8.5.14-1.1 on GA media 2026-10-03T01:22:42.134729+00:00

grafana-8.5.14-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:3642 RHSA-2023:3642 — Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update 2026-10-03T01:22:42.134748+00:00

ramda: prototype poisoning eventsource: Exposure of Sensitive Information golang: net/http: improper sanitization of Transfer-Encoding header golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters marked: regular expression block.def may lead Denial of Service marked: regular expression inline.reflinkSearch may lead Denial of Service grafana: Use of Cache Containing Sensitive Information golang: encoding/pem: fix stack overflow in Decode Moment.js: Path traversal in moment.locale grafana: An information leak issue was discovered in Grafana through 7.3.4, when integrated with Zabbix golang: net/http: handle server errors after sending GOAWAY golang: encoding/xml: stack exhaustion in Decoder.Skip golang: crypto/elliptic: panic caused by oversized scalar golang: syscall: faccessat checks wrong group golang: crypto/tls: session tickets lack random ticket_age_add golang: io/fs: stack exhaustion in Glob golang: compress/gzip: stack exhaustion in Reader.Read golang: path/filepath: stack exhaustion in Glob golang: encoding/xml: stack exhaustion in Unmarshal golang: encoding/gob: stack exhaustion in Decoder.Decode grafana: stored XSS vulnerability grafana: OAuth account takeover grafana: plugin signature bypass grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat…

 https://cve.radiocsirt.org/vuln/suse-su-2023:0352-1 SUSE-SU-2023:0352-1 — Security update for SUSE Manager Client Tools 2026-10-03T01:22:42.134825+00:00

Security update for SUSE Manager Client Tools

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-39229 UBUNTU-CVE-2022-39229 2026-10-03T01:22:42.134844+00:00

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1702 WID-SEC-W-2022-1702 — Grafana: Mehrere Schwachstellen 2026-10-03T01:22:42.134869+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.