Most recent entries from all

ALSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: AlmaLinux:10: grafana, AlmaLinux:10: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-14126

BIT-grafana-2026-8609 — Pre-authentication denial of service via the OAuth login route

Affected: Bitnami: grafana

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

EUVD-2026-360214

fkie_cve-2026-8609

GHSA-j7jj-549c-j492

openSUSE-SU-2026:11619-1 — grafana-12.4.5-4.1 on GA media

grafana-12.4.5-4.1 on GA media

RHSA-2026:63164 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route grafana: Grafana: Privilege escalation via broken access control grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads qs: qs: Denial of Service via improper validation in stringify function qs: qs: Denial of Service via array limit bypass in query string parsing js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

RLSA-2026:54178 — Moderate: grafana security, bug fix, and enhancement update

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)

* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)

* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)

* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

WID-SEC-W-2026-2289 — Grafana: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Denial of Service Angriff durchzuführen oder Cross-Site-Scripting-Angriffe durchzuführen.