Most recent entries from all

ALSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-14093

BIT-grafana-2026-33382 — Denial of service via unbounded request body size

Affected: Bitnami: grafana

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

EUVD-2026-360200

fkie_cve-2026-33382

GHSA-xcrv-g5fh-9wx2

openSUSE-SU-2026:11277-1 — grafana-12.4.5-1.1 on GA media

grafana-12.4.5-1.1 on GA media

RHSA-2026:63164 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route grafana: Grafana: Privilege escalation via broken access control grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads qs: qs: Denial of Service via improper validation in stringify function qs: qs: Denial of Service via array limit bypass in query string parsing js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

RLSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:3713-1 — Security update for Multi-Linux Manager Client Tools - Monitoring stack

Security update for Multi-Linux Manager Client Tools - Monitoring stack

WID-SEC-W-2026-2289 — Grafana: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen oder Cross-Site-Scripting-Angriffe durchzuführen.