https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:32:50 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:2914 <p><strong>Affected:</strong> AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>Security Fix(es):</p> <p>* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>Security Fix(es):</p> <p>* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:2914 https://cve.radiocsirt.org/vuln/bdu:2026-01120 bdu:2026-01120 https://cve.radiocsirt.org/vuln/bdu:2026-01120 https://cve.radiocsirt.org/vuln/bit-grafana-2026-21721 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2026-21721 https://cve.radiocsirt.org/vuln/euvd-2026-360208 EUVD-2026-360208 https://cve.radiocsirt.org/vuln/euvd-2026-360208 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21721 <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21721 https://cve.radiocsirt.org/vuln/ghsa-jgfq-mgxg-4qwm <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> https://cve.radiocsirt.org/vuln/ghsa-jgfq-mgxg-4qwm https://cve.radiocsirt.org/vuln/opensuse-su-2026:20654-1 <p>Security update for grafana</p> <p>Security update for grafana</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20654-1 https://cve.radiocsirt.org/vuln/rhsa-2026:3078 <p>grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation</p> <p>grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:3078 https://cve.radiocsirt.org/vuln/suse-su-2026:1013-1 <p>Security update 5.0.7 for Multi-Linux Manager Client Tools</p> <p>Security update 5.0.7 for Multi-Linux Manager Client Tools</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1013-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21721 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-21721 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0224 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen oder sich erhöhte Berechtigungen zu verschaffen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen oder sich erhöhte Berechtigungen zu verschaffen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0224