{"id":"CVE-2026-33377","aliases":["ALSA-2026:54178","ALSA-2026:54243","ALSA-2026:58982","BIT-grafana-2026-33377","CLSA-2026-1781093705","CLSA-2026-1781253433","EUVD-2026-30143","GHSA-5cv7-h7gr-wjgh","RHSA-2026:54178","RHSA-2026:54243","RHSA-2026:58982","RHSA-2026:67517","RHSA-2026:67518","RHSA-2026:68767","RHSA-2026:68778","RHSA-2026:68821","RHSA-2026:76795","RHSA-2026:76809","RLSA-2026:54178","RLSA-2026:54243","RLSA-2026:58982","SUSE-SU-2026:2768-1","SUSE-SU-2026:2774-1","SUSE-SU-2026:3718-1","UBUNTU-CVE-2026-33377","openSUSE-SU-2026:10932-1","openSUSE-SU-2026:20940-1"],"status":"published","title":"Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00226,"percentile":0.13387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-287"],"published":"2026-05-13T19:28:28Z","modified":"2026-10-29T11:42:23Z","fixes":[{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.14","12.2.8","12.3.6","12.4.3","13.0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"11.6.14"},{"introduced":"12.0.0"},{"fixed":"12.2.8"},{"introduced":"12.3.0"},{"fixed":"12.3.6"},{"introduced":"12.4.0"},{"fixed":"12.4.3"},{"introduced":"13.0.0"},{"fixed":"13.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.9-4.el9_2.alma.1.tuxcare.els17"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-15.el9_6.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-26.el10_0"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.5.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.6.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-28.el9_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-28.el9_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-28.el9_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-28.el9_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.9-13.el9_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.9-13.el9_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.9-13.el9_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:10","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-28.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.2.6-23.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.9.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.11.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-150002.3.13.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-150002.4.21.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.11.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-150002.3.3.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"python-defusedxml-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-150002.1.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.8-150002.3.12.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150002.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.12-150002.3.17.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.12-150002.3.17.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150200.3.91.1"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-bp160.1.1"}]}],"bundled":24}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33377","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33377","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5cv7-h7gr-wjgh"},{"url":"https://access.redhat.com/errata/RHSA-2026:54178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33376","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33377","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33382","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477246","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477262","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499061","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499062","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-54178.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-42127.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54243","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42127","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-54243.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58982","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-58982.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781093705.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33378","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781253433.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33377.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499062","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-188282","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54178.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8609","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-8609","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33376","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33376","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33377","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33382","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33382","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42127","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-42127","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54243.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-242865","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-242866","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58982.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67517","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67517.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27137","tags":["advisory"]},{"url":"https://go.dev/cl/752182","tags":["article"]},{"url":"https://go.dev/issue/77952","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4599","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","tags":["advisory"]},{"url":"https://go.dev/cl/781701","tags":["article"]},{"url":"https://go.dev/issue/79572","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5027","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67518","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67518.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68767","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33380","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33378","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28374","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33381","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28376","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28383","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68767.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28374","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28374","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28376","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28376","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28379","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28379","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28380","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28380","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28383","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28383","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33378","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33378","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477248","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33380","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33380","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477239","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33381","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68778","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81871","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81872","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68778.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81871","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81872","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/issues/6797","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/8620","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92599","tags":["advisory"]},{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68821","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61709","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68821.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709","tags":["advisory"]},{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","tags":["article"]},{"url":"https://github.com/openfga/openfga/releases/tag/v1.18.1","tags":["article"]},{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76795","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76795.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76809","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76809.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54178","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54243","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:58982","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262768-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1229105","tags":["report"]},{"url":"https://bugzilla.suse.com/1232641","tags":["report"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1248707","tags":["report"]},{"url":"https://bugzilla.suse.com/1249400","tags":["report"]},{"url":"https://bugzilla.suse.com/1249532","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1259739","tags":["report"]},{"url":"https://bugzilla.suse.com/1260806","tags":["report"]},{"url":"https://bugzilla.suse.com/1260870","tags":["report"]},{"url":"https://bugzilla.suse.com/1260905","tags":["report"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://bugzilla.suse.com/1261902","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262409","tags":["report"]},{"url":"https://bugzilla.suse.com/1262708","tags":["report"]},{"url":"https://bugzilla.suse.com/1262760","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263157","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266012","tags":["report"]},{"url":"https://bugzilla.suse.com/1266556","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1267153","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262774-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226578","tags":["report"]},{"url":"https://bugzilla.suse.com/1234567","tags":["report"]},{"url":"https://bugzilla.suse.com/1238890","tags":["report"]},{"url":"https://bugzilla.suse.com/1242916","tags":["report"]},{"url":"https://bugzilla.suse.com/1245107","tags":["report"]},{"url":"https://bugzilla.suse.com/1247707","tags":["report"]},{"url":"https://bugzilla.suse.com/1249243","tags":["report"]},{"url":"https://bugzilla.suse.com/1253032","tags":["report"]},{"url":"https://bugzilla.suse.com/1254900","tags":["report"]},{"url":"https://bugzilla.suse.com/1257583","tags":["report"]},{"url":"https://bugzilla.suse.com/1257894","tags":["report"]},{"url":"https://bugzilla.suse.com/1258041","tags":["report"]},{"url":"https://bugzilla.suse.com/1258079","tags":["report"]},{"url":"https://bugzilla.suse.com/1258144","tags":["report"]},{"url":"https://bugzilla.suse.com/1258382","tags":["report"]},{"url":"https://bugzilla.suse.com/1258816","tags":["report"]},{"url":"https://bugzilla.suse.com/1259087","tags":["report"]},{"url":"https://bugzilla.suse.com/1259230","tags":["report"]},{"url":"https://bugzilla.suse.com/1259261","tags":["report"]},{"url":"https://bugzilla.suse.com/1259474","tags":["report"]},{"url":"https://bugzilla.suse.com/1259479","tags":["report"]},{"url":"https://bugzilla.suse.com/1259482","tags":["report"]},{"url":"https://bugzilla.suse.com/1259521","tags":["report"]},{"url":"https://bugzilla.suse.com/1259590","tags":["report"]},{"url":"https://bugzilla.suse.com/1259591","tags":["report"]},{"url":"https://bugzilla.suse.com/1259700","tags":["report"]},{"url":"https://bugzilla.suse.com/1259787","tags":["report"]},{"url":"https://bugzilla.suse.com/1259960","tags":["report"]},{"url":"https://bugzilla.suse.com/1260031","tags":["report"]},{"url":"https://bugzilla.suse.com/1260614","tags":["report"]},{"url":"https://bugzilla.suse.com/1261305","tags":["report"]},{"url":"https://bugzilla.suse.com/1261307","tags":["report"]},{"url":"https://bugzilla.suse.com/1261327","tags":["report"]},{"url":"https://bugzilla.suse.com/1261631","tags":["report"]},{"url":"https://bugzilla.suse.com/1261723","tags":["report"]},{"url":"https://bugzilla.suse.com/1261753","tags":["report"]},{"url":"https://bugzilla.suse.com/1261841","tags":["report"]},{"url":"https://bugzilla.suse.com/1262090","tags":["report"]},{"url":"https://bugzilla.suse.com/1262285","tags":["report"]},{"url":"https://bugzilla.suse.com/1262460","tags":["report"]},{"url":"https://bugzilla.suse.com/1262471","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262595","tags":["report"]},{"url":"https://bugzilla.suse.com/1262720","tags":["report"]},{"url":"https://bugzilla.suse.com/1262761","tags":["report"]},{"url":"https://bugzilla.suse.com/1263814","tags":["report"]},{"url":"https://bugzilla.suse.com/1263841","tags":["report"]},{"url":"https://bugzilla.suse.com/1264149","tags":["report"]},{"url":"https://bugzilla.suse.com/1264174","tags":["report"]},{"url":"https://bugzilla.suse.com/1264234","tags":["report"]},{"url":"https://bugzilla.suse.com/1264256","tags":["report"]},{"url":"https://bugzilla.suse.com/1264966","tags":["report"]},{"url":"https://bugzilla.suse.com/1265134","tags":["report"]},{"url":"https://bugzilla.suse.com/1265319","tags":["report"]},{"url":"https://bugzilla.suse.com/1265358","tags":["report"]},{"url":"https://bugzilla.suse.com/1265975","tags":["report"]},{"url":"https://bugzilla.suse.com/1269253","tags":["report"]},{"url":"https://bugzilla.suse.com/1269534","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42198","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263718-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-33377","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33377","title":"Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T19:28:28.154Z","modified":"2026-08-27T17:22:32.185Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-30143","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T19:28:28Z","modified":"2026-08-27T17:22:32Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-5cv7-h7gr-wjgh","title":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard...","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T21:32:06Z","modified":"2026-06-02T21:31:40Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-284","CWE-287"],"updated_at":"2026-11-02T15:08:30.717444Z"}],"nvd":[{"id":"CVE-2026-33377","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T20:16:20.47Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287","CWE-284"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-33377","title":"Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T19:28:28.154Z","modified":"2026-10-28T02:31:05.594851897Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"RHSA-2026:54178","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2026-08-12T10:16:44Z","modified":"2026-10-10T10:13:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54243","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-09-17T10:14:40Z","modified":"2026-10-10T10:13:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58982","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2026-08-25T10:23:08Z","modified":"2026-10-10T10:15:14Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:67517","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-09-16T10:14:49Z","modified":"2026-10-20T10:13:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67518","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-09-16T10:14:49Z","modified":"2026-10-20T10:13:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68767","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:19:30Z","modified":"2026-10-17T10:18:41Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68778","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:31Z","modified":"2026-10-17T10:18:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68821","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:32Z","modified":"2026-10-20T10:14:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:76795","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-10-07T10:20:14Z","modified":"2026-10-20T10:16:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76809","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2026-10-07T10:20:14Z","modified":"2026-10-20T10:16:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:54178","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n\n* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\n* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n\n* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\nBug Fix(es) and Enhancement(s):\n\n* [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188282)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-13T12:07:38.295651Z","modified":"2026-08-13T12:30:03.570416484Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:54243","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n\n* grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-16T18:01:29.567783Z","modified":"2026-09-16T18:24:35.060939636Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:58982","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n\n* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\nBug Fix(es) and Enhancement(s):\n\n* Avoid  unbounded memory growth [rhel-9.8.z] (JIRA:Rocky Linux-242865)\n\n* Limit the size of the request body before processing it (JIRA:Rocky Linux-242866)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T12:04:25.60621Z","modified":"2026-08-25T23:50:43.829796902Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-33377","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-13T20:16:00Z","modified":"2026-05-20T22:02:58.899640332Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:54178","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n  * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n  * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-12T00:00:00Z","modified":"2026-10-29T11:42:23.616070713Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:54243","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-12T00:00:00Z","modified":"2026-10-29T11:02:28.878578267Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:58982","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n  * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Avoid unbounded memory growth [almalinux-9.8.z] (JIRA:AlmaLinux-242865)\n  * Limit the size of the request body before processing it (JIRA:AlmaLinux-242866)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-10-29T11:32:36.446062843Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"BIT-grafana-2026-33377","title":"Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin","description":"An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.","status":"published","published":"2026-05-15T08:42:45.411Z","modified":"2026-09-08T08:47:51.487237825Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"CLSA-2026-1781093705","title":"grafana: Fix of 3 CVEs","description":"- CVE-2026-33376: fix auth proxy IPv6 allow-list bypass (use /128 mask for IPv6, not /32)\n- CVE-2026-33377: fix dashboard import privilege escalation (set default dashboard\n  permissions only for newly created dashboards, not when overwriting an existing one)","status":"published","published":"2026-06-10T12:19:00Z","modified":"2026-10-26T09:30:18.933658086Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781253433","title":"grafana: Fix of 2 CVEs","description":"- CVE-2026-33376: fix auth proxy IPv6 allow-list entries without an explicit\n  mask being coerced to /32 instead of /128, which widened the allowed source\n  address range\n- CVE-2026-33377: fix privilege escalation where an Editor overwriting an\n  existing dashboard via the import API had default permissions re-applied,\n  granting them Admin on that dashboard; default permissions are now only set\n  for newly created dashboards","status":"published","published":"2026-06-12T08:37:45Z","modified":"2026-10-26T09:31:08.504984871Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:10932-1","title":"grafana-11.6.14+security04-1.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.14+security04-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-06-03T08:30:25.095318495Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20940-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14+security-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server’s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14+security-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references\n","status":"published","published":"2026-06-10T12:02:03Z","modified":"2026-06-13T18:24:19.477495413Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2768-1","title":"Security update 5.1.4 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot updated to version 1.2.1:\n\n- Key Update Highlights (v1.2.1)\n  - Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option\n    (bsc#1260870)\n  - Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s\n  - Introduce rd.saltboot namespace for all options, mark old as deprecated\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security issues fixed:\n  - CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter\n    (bsc#1248699)\n\ngolang-github-boynux-squid_exporter:\n\n- Non customer facing changes\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Non customer facing changes\n\ngolang-github-prometheus-alertmanager:\n\n- Non customer facing changes\n\ngolang-github-prometheus-node_exporter updated to version 1.10.2:\n    \n- Key Update Highlights (v1.10.0 to v1.10.2):\n  - New Collectors: Added new collectors for PCIe devices and swaps.\n  - New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)\n  - Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a\n    logging race condition in systemd.\n  - Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.\n  - Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)\n\ngolang-github-prometheus-prometheus updated to version 3.5.3:\n\n- Security issues fixed:\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (v3.5.3) (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit\n    (v3.5.3) (bsc#1263987)\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels\n    (v3.5.2) (bsc#1262222).\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0\n    (backported patch) (bsc#1266608)\n\n- Other changes:\n  - Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)\n  - Internal update with non customer facing changes (v3.5.1)\n\ngrafana updated to version 11.6.14+security-04:\n\n- Security issues fixed in v11.6.14+security-04:\n  - CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)\n  - CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)\n  - CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)\n  - CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)\n  - CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)\n  - CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)\n  - CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)\n  - CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)\n  - CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)\n  - CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary\n    files from the Grafana server’s filesystem (bsc#1265282)\n- Security issues fixed through backported patches:\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by\n    updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n  - CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: \n    Fixed multiple issues when parsing HTML files (bsc#1267153)\n\nmgr-push updated to version 5.2.4:\n\n- Internal updates with no customer facing changes across versions (v5.2.1-0 to v5.2.4-0)\n\nprometheus-blackbox_exporter:\n\n- Security issues fixed:\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by\n    updating golang.org/x/net to version 0.55.0 (bsc#1266556)\n\nprometheus-postgres_exporter:\n\n- Security issues fixed:\n  - CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter\n    (bsc#1248699)\n\nrhnlib updated to version 5.2.5:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.5-0)\n\nspacecmd updated to version 5.2.8:\n\n- Key Update Highlights (v5.2.3-0):\n  - Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  - Add subcommand to check if reboot is needed after applying all available patches\n- Key Update Highlights (v5.2.1-0):\n  - Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n  - Fixed methods in api namespace in spacecmd (bsc#1249532)\n- Other changes (v5.2.2-0 to 5.2.8-0):\n  - Translation strings updates\n  - Internal updates with non customer facing changes\n\nspacewalk-client-tools updated to version 5.2.6:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.6-0)\n\nsupportutils-plugin-salt:\n\n- Non customer facing changes\n\nsupportutils-plugin-susemanager-client updated to version 5.2.3:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.3-0)\n\nuyuni-tools updated to version 5.2.12:\n\n- Key Update Highlights (v5.2.11-0)\n  - Improved pod readiness checks (bsc#1266012)\n- Key Update Highlights (v5.2.10-0)\n  - Preserve hub replicas during upgrade (bsc#1262708)\n  - Added mgrctl 'ssh' and 'ssh remove_known_host' commands\n  - Fixed startup checks for main server container (bsc#1263157)\n  - Fixed service dependencies (bsc#1263823)\n  - Updated default tag to 5.1.3.1 (bsc#1262760)\n  - Fixed missing registry for db image (bsc#1259739)\n  - Internal SANs for db and reportdb are no longer required\n  - Generate the same certificate for server and reportdb\n  - Fixed Report DB CA certificate (bsc#1260806)\n  - Removed waitForTraefik function (bsc#1261902)\n- Key Update Highlights (v5.2.8-0)\n  - Generate service template only after secrets are created\n- Key Update Highlights (v5.2.7-0)\n  - Admin secrets no longer required on upgrades (bsc#1262409)\n- Key Update Highlights (v5.2.6-0):\n  - Use podman secrets for SSL on proxy\n  - Fixed database online backup\n  - mgrctl copy command now infers target name automatically\n  - Restored TFTP port to proxy (bsc#1260905)\n  - TFTP disabled by default on server\n  - Fixed incorrect package dependencies declaration (bsc#1229105)\n  - Prevent cobbler port from being exposed\n  - Bumped zerolog to 1.34\n  - Ignore spacewalk-service stop return code.\n  - Stop automatically unhealthy container\n  - Use container based server setup instead tools bundled one\n- Key Update Highlights (v5.2.5-0)\n  - Removed migrate command\n  - Removed hub register command\n  - Split TFTP server into separate container\n  - Removed Kubernetes install/upgrade from mgrpxy\n- Key Update Highlights (v5.2.1-0)\n  - Fixed --dbupgrade-tag parameter (bsc#1249400)\n  - Added --registry-host, --registry-user, --registry-password options\n  - Deprecated --registry option\n  - Added SUSE Linux Enterprise 15 SP7 support\n  - Migrated custom SSL CA certificates (bsc#1232641)\n- Other changes (v5.2.1-0 to v5.2.12-0):\n  - Translation strings updates\n  - Internal updates with version bump but without customer facing changes\n \nuyuni-common-libs updated to version 5.2.5:\n\n- Key Update Highlights (v5.2.5-0):\n  - Cleaned up the checksum module by removing legacy MD5/SHA1 fallback imports in favor of using\n    standard hashlib directly\n- Other changes:\n  - Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.5-0)\n\n","status":"published","published":"2026-07-06T07:48:36Z","modified":"2026-07-07T08:30:04.923782054Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2774-1","title":"Security update 5.1.4 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nRelease Notes Highlights:\n    \n- Update to SUSE Multi-Linux Manager 5.1.4\n  * Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions\n  * Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0\n  * SUSE Liberty Linux 9.6 Support\n  * New API Endpoint - listMigrationTargetsWithChannels\n  * Debian 12 End-of-Life Notice\n  * SUSE Registry URL Change\n  * Security fixes:\n    CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198\n    CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154\n    CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380\n    CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378\n    CVE-2026-33380, CVE-2026-33381\n  * Bugs mentioned:\n    bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107\n    bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583\n    bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382\n    bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474\n    bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591\n    bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031\n    bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327\n    bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902\n    bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492\n    bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814\n    bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966\n    bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012\n    bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174\n    bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289\n    bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284\n    bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534\n\nContainer images and uyuni-tools changes:\n\nserver-attestation-image:\n\n- Version 5.1.15\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-hub-xmlrpc-api-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-image:\n\n- Version 5.1.15\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added mozilla-nss-sysinit to Dockerfile required for FIPS\n    (bsc#1247707)\n  * Do not get repositories from SCC in the server container\n    (bsc#1242916)\n  * Added 'susemanager-tools', 'susemanager' and\n    'susemanager-tools-salt' packages to server-image\n\nserver-migration-14-16-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies\n     for SUSE Multi-Linux Manager 5.1.4\n\nserver-postgresql-image:\n\n- Version 5.1.13\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)\n\nserver-saline-image:\n\n- Version 5.1.14\n  * Use python3*-tornado6 package to make it working with Python 3.11\n\nuyuni-tools:\n\n- Version 5.1.29-0\n  Check backup status only after database is started (bsc#1262492)\n- Version 5.1.28-0\n  * Remove waitForTraefik function (bsc#1261902)\n  * Fix inspect: missing registry for db image (bsc#1259739)\n  * Preserve hub replicas during upgrade (bsc#1262708)\n  * Stop automatically unhealthy container\n  * Ignore spacewalk-service stop return code.\n  * Use correct CA for Report DB (bsc#1260806)\n  * Do not call podman healthcheck run to wait for pods to be ready\n    (bsc#1266012)\n\n\nThe following packages are underlying build dependencies\nand system components used by the containers:\n\n\ncobbler:\n\n- Added the distro signature for rhel10 (bsc#1265134)\n\nliberate-formula:\n\n- Version 0.1.4\n  * No customer facing changes\n- Version 0.1.3\n  * Liberate formula support for EL10 (bsc#1265975)\n\nprometheus-exporters-formula:\n\n- Version 1.4.3\n  * Added support for Python 3.13\n  * Drop migrate_formula_data script as it is obsolete\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with\n  version 1.11.1 (bsc#1248699)\n\nsaline:\n\n- Update to version 2026.05.18:\n  * Explicitly set port number for Prometheus target\n  * Fixed the issue of using non-vendored tornado with Python 3.11\n\nsalt:\n\n- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n\nsaltboot-formula:\n\n- Update to version 1.1.0\n  * When autoselecting saltboot device, ignore cd/dvd (bsc#1259960)\n\nspacecmd:\n\n- Version 5.1.14-0\n  * Update translation strings\n\nspacewalk-backend:\n\n- Version 5.1.17-0\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Use PBKDF2-SHA256 (600000 iterations) for new\n    password hashes; verify legacy SHA-256 crypt(3)\n    hashes transparently\n\nspacewalk-java:\n\n- Version 5.1.28-0\n  * Check access rights on two formula API calls (bsc#1269253)\n  * Sanitize uploaded image name (bsc#1269534)\n- Version 5.1.26-0\n  * Added listMigrationTargetsWithChannels endpoint to return\n    the valid migration targets channels (jsc#SUMA-320)\n  * Fixed CSV export failure on system Details \u003e Custom Info page\n  * Added support for migration from SLES 15 to SLES 16\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Updated the tab label for eligible subscription\n    systems (bsc#1249243)\n  * Fixed missing field labels in the Create User form.\n    (bsc#1259591)\n  * Enhance buttons readability and consistency across the product\n  * Fixed missing translations (bsc#1259787)\n  * Fixed hub SCC forwarding registration credential filter\n    (bsc#1260031)\n  * Sanitize inputs to avoid injection in rhn_conf\n    of http proxy settings inputs (bsc#1245107)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Make OIDC JWKS initialization startup-safe\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Run ANALYZE asynchronously after CLM alignment to avoid\n    deadlocks (bsc#1261753)\n  * Fixed enforcement of consecutive chars in password policy\n    (bsc#1262761)\n  * Use salt's network module if host or nslookup are not installed\n    (bsc#1262720)\n  * Fixed Remote Commands hang on direct hostname (bsc#1226578)\n  * Fixed Python SyntaxWarning for invalid escape sequence '\\s' in\n    RHUI extract repo data script (bsc#1262595)\n  * Added 'unpushed' to AdvisoryStatus enum to handle EPEL errata\n    with unpushed status (bsc#1264234)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Remove validation of packages in kickstart profiles which are\n    not supported anymore (bsc#1259474)\n  * Numeric branch names should not be stored in double format\n    (bsc#1258382)\n  * Added missing pxeeventfailed notification message\n  * Do not add non-FQDN hostnames to the proxy fqdn list\n    (bsc#1263841)\n  * Use supscription matcher output for subscription expiration\n    warning (bsc#1257894)\n  * Fixed Oval data sync for ubuntu 26.04 (bsc#1265319)\n  * Recognize PBKDF2-SHA256 hashes alongside legacy\n    SHA-256 crypt(3) in the Java password check helpers\n  * security(saml2): default signature algorithm to rsa-sha256 (bsc#1234567)\n  * security(tls): remove TLSv1/TLSv1.1, allow TLSv1.3 for SMTP (bsc#1234567)\n  * Fixed CSRFTokenValidator FIPS compatibility by using\n    platform-default SecureRandom (bsc#1247707)\n  * Fixed conflicting cobbler system migrations\n\nspacewalk-web:\n\n- Version 5.1.21-0\n  * UI changes to support migration from SLES 15 to SLES 16\n  * Fixed issue causing a blank tab to appear in the\n    Image Building Details page (bsc#1253032)\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Fixed an issue where the 'Create Token' modal could\n    become unresponsive when opened\n  * Fixed an issue causing all existing tokens to be\n    deleted in a loop\n  * Improved visibility of all parent rows in permissions table\n  * Enhance buttons placement for a more intuitive experience\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Align subscription matching page warning with dashboard\n    warning for expiring subscriptions (bsc#1257894)\n  * Added missing fragment import (bsc#1264966)\n\nsubscription-matcher:\n\n- Version 0.44\n  * Fixed 2 missing part numbers (bsc#1264256)\n\nsusemanager:\n\n- Version 5.1.17-0\n  * Added SUSE LibertyLinux 9.6 x86_64 bootstrap repository definition\n  * Removed spacewalk-diskcheck enablement\n  * Use correct CA for Report DB (bsc#1260806)\n  * Relicensed mgr-salt-ssh under Apache-2.0 and move it\n    to a separated package named susemanager-tools-salt\n\nsusemanager-build-keys:\n\n- Added Nvidia Cuda Tools key\n  Added: nvidia-cudatools-9CD0A493D42D0685.asc\n\nsusemanager-docs_en:\n\n- Updated the supported features table in the Client Configuration\n  Guide to include Red Hat Linux Enterprise 10 and clones\n- Added documentation on space usage percentage on the server and db\n  container which can be set using DISKCHECKALERT and DISKTHRESHOLD\n- Added Code 16 to Monitoring documentation (bsc#1263814)\n- Added documentation for deleting SCAP scan results to Administration\n  Guide (bsc#1262471)\n- Rephrased instructions for RBAC in Administration Guide (bsc#1258079)\n- Added troubleshooting section for BTRFS to Administration\n  Guide (bcs#1258816)\n- Removed mentions of Leap 15.5 and 15.4 and specified SUSE requiring\n  general or LTS support in Client Configuration Guide (bsc#1262285)\n- Added information about availability of SLE 16 and SL Micro 6.2\n  support in the product versions 5.1.2 and later (bsc#1260614)\n- Removed mention of CIS profile (bsc#1262460)\n- Corrected path for Salt minion in Retail Guide (#1262090)\n- Added explanation for translating mgradm arguments to YAML in\n  Installation and Upgrade Guide (bsc#1258144)\n- Removed Google Cloud Compute from PAYG documentation (bsc#1261631)\n- Added link to proxy creation from client to an existing document in\n  Installation and Upgrade Guide\n- Updated features table for EL 10 based distributions\n- Document Debian 13\n- Added support for Open Enterprise Server 25.4\n- Clarified how to get PTF images in air-gapped setup in Installation\n  and Upgrade Guide (bsc#1261307)\n- SUSE Multi-Linux Support does not support autoinstallation\n  (bsc#1259261)\n- Added instructions about accessing git repositories when building\n  images to Administration Guide\n- Added online database backup instructions to Administration Guide\n- Fixed comamnd for product deployment in Installation and Upgrade\n  Guide (bsc#1259479)\n- Added online database backup instructions\n\nsusemanager-schema:\n\n- Version 5.1.19-0\n  * Added the RBAC mapping for listMigrationTargetsWithChannels\n    end point (jsc#SUMA-320)\n  * Added index on rhnPackage (checksum_id) (bsc#1258041)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Added 'unpushed' to rhn_errata_adv_status_ck constraint to\n    allow importing EPEL errata with unpushed status (bsc#1264234)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added missing indexes for channels and tokens (bsc#1259590)\n  * Increase source_url on table rhncontentsource (bsc#1259230)\n\nsusemanager-sls:\n\n- Version 5.1.25-0\n  * Added salt states to support migration from SLES 15 to SLES 16\n  * Ignore podman interfaces when resolving FQDNs (bsc#1262720)\n  * Fixed GPG key import on first key deploy (bsc#1259482)\n  * Use either ansible-core or ansible packages\n    for Ansible Control node, prefer ansible-core (bsc#1259087)\n  * Fixed CPU reporting for ppc64le clients (bsc#1259521)\n  * Fixed refresh of virtual instance information (bsc#1261723)\n\nsusemanager-sync-data:\n\n- Version 5.1.10-0\n  * Added missing RES-EMS channel family (bsc#1265358)\n- Version 5.1.9-0\n  * Added SUSE Liberty Linux 9.6 x86_64 product entries\n\nuyuni-common-libs:\n\n- Version 5.1.6-0\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Replaced deprecated inspect.getargspec with EAFP usedforsecurity detection\n\nuyuni-reportdb-schema:\n\n- version 5.1.7-0\n  * Increased url on table repository (bsc#1259230)\n\nuyuni-setup-reportdb:\n\n- Version 5.1.5-0\n  * Fixed delete of a reportdb user with uyuni-setup-reportdb-user\n    (bsc#1261841)\n\n\nvirtual-host-gatherer:\n\n- Version 1.0.31-0\n  * Dropped SUSECloud module as not longer maintainednor used\n- Version 1.0.30-0\n  * No customer facing changes\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Upgrade mgradm and mgrctl.\n3. If you are in a disconnected environment, upgrade the image packages.\n4. Reboot the system.\n5. Run `mgradm upgrade podman` which will use the default image tags.\n","status":"published","published":"2026-07-06T07:52:25Z","modified":"2026-07-07T08:30:06.278184108Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T09:23:40Z","modified":"2026-08-26T18:23:35.632543325Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}