https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:44:19.046193+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:54178 ALSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update 2026-10-03T07:44:19.248827+00:00

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-14093 bdu:2026-14093 2026-10-03T07:44:19.248901+00:00 bdu:2026-14093 https://cve.radiocsirt.org/vuln/bit-grafana-2026-33382 BIT-grafana-2026-33382 — Denial of service via unbounded request body size 2026-10-03T07:44:19.248920+00:00

Affected: Bitnami: grafana

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

 https://cve.radiocsirt.org/vuln/euvd-2026-360200 EUVD-2026-360200 2026-10-03T07:44:19.248943+00:00 EUVD-2026-360200 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33382 fkie_cve-2026-33382 2026-10-03T07:44:19.248955+00:00

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-xcrv-g5fh-9wx2 GHSA-xcrv-g5fh-9wx2 2026-10-03T07:44:19.248976+00:00

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11277-1 openSUSE-SU-2026:11277-1 — grafana-12.4.5-1.1 on GA media 2026-10-03T07:44:19.248991+00:00

grafana-12.4.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:63164 RHSA-2026:63164 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T07:44:19.249038+00:00

grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route grafana: Grafana: Privilege escalation via broken access control grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads qs: qs: Denial of Service via improper validation in stringify function qs: qs: Denial of Service via array limit bypass in query string parsing js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

 https://cve.radiocsirt.org/vuln/rlsa-2026:54178 RLSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update 2026-10-03T07:44:19.249096+00:00

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:3713-1 SUSE-SU-2026:3713-1 — Security update for Multi-Linux Manager Client Tools - Monitoring stack 2026-10-03T07:44:19.249124+00:00

Security update for Multi-Linux Manager Client Tools - Monitoring stack

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2289 WID-SEC-W-2026-2289 — Grafana: Mehrere Schwachstellen 2026-10-03T07:44:19.249143+00:00

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen oder Cross-Site-Scripting-Angriffe durchzuführen.