grafana vulnerabilities (SUSE)
350 vulnerabilities.
-
grafanaSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
grafanaSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
grafanaSUSE Broken access control in dashboard snapshots 6.3 Medium -
grafanaSUSE CVE-2026-17033 CVE Record 6.8 Medium -
grafanaSUSE CVE-2026-17183 CVE Record 7.1 High -
grafanaSUSE pip absolute path traversal during download from malicious package indexes 5.6 Medium -
grafanaSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
grafanaSUSE CVE-2026-21723 Record 5.3 Medium -
grafanaSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
grafanaSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
grafanaSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
grafanaSUSE Denial of service via unbounded request body size 7.5 High -
grafanaSUSE Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 8.7 High -
grafanaSUSE Tarfile.extract() doesn't fully respect filter parameter 2.0 Low -
grafanaSUSE brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 7.7 High -
grafanaSUSE lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
grafanaSUSE tarfile opened in streaming mode mishandles EOF 8.2 High -
grafanaSUSE Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium -
grafanaSUSE tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
grafanaSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
grafanaSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
grafanaSUSE tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
grafanaSUSE Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
grafanaSUSE sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
grafanaSUSE Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
grafanaSUSE tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
grafanaSUSE Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
grafanaSUSE React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
grafanaSUSE React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
grafanaSUSE React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
grafanaSUSE React Router has stored XSS via unescaped Location header in prerendered redirect HTML 5.4 Medium -
grafanaSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
grafanaSUSE pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
grafanaSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
grafanaSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
grafanaSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
grafanaSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
grafanaSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
grafanaSUSE Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
grafanaSUSE Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
grafanaSUSE FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 5.9 Medium -
grafanaSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
grafanaSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
grafanaSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
grafanaSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
grafanaSUSE SQL Expressions Read File From Disk 6.3 Medium -
grafanaSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
grafanaSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
grafanaSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
grafanaSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium - Show olderLoading…