Most recent entries from all

ALSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

2026-10-03T04:24:19.538658+00:00

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07034

2026-10-03T04:24:19.538749+00:00

bdu:2026-07034

BIT-grafana-2026-33377 — Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

2026-10-03T04:24:19.538769+00:00

Affected: Bitnami: grafana

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

certfr-2026-avi-0989 — De multiples vulnérabilités ont été découvertes dans HPE Aruba Networking Private 5G Core. Elles permettent à un attaqu…

2026-10-03T04:24:19.538792+00:00

certfr-2026-avi-0989

EUVD-2026-360206

2026-10-03T04:24:19.538808+00:00

EUVD-2026-360206

fkie_cve-2026-33377

2026-10-03T04:24:19.538820+00:00

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

GHSA-5cv7-h7gr-wjgh

2026-10-03T04:24:19.538840+00:00

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

RHSA-2026:42852 — Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update

2026-10-03T04:24:19.538853+00:00

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default grafana: Grafana: Privilege escalation via dashboard overwrite net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

RHSA-2026:54178 — Red Hat Security Advisory: grafana security, bug fix, and enhancement update

2026-10-03T04:24:19.538897+00:00

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default grafana: Grafana: Privilege escalation via dashboard overwrite grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

RLSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

2026-10-03T04:24:19.538920+00:00

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:2774-1 — Security update 5.1.4 for Multi-Linux Manager Server

2026-10-03T04:24:19.538954+00:00

Security update 5.1.4 for Multi-Linux Manager Server

UBUNTU-CVE-2026-33377

2026-10-03T04:24:19.538979+00:00

Affected: Ubuntu:16.04:LTS: grafana

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

WID-SEC-W-2026-1546 — Grafana: Mehrere Schwachstellen

2026-10-03T04:24:19.538995+00:00

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.