grafana vulnerabilities (SUSE)
350 vulnerabilities.
grafanaSUSEViewer-triggered race condition in Grafana Live leads to complete server crash6.5 MediumgrafanaSUSEThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection6.3 MediumgrafanaSUSEurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 HighgrafanaSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 HighgrafanaSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 HighgrafanaSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 HighgrafanaSUSEApache Thrift: C++ JSON OOB read6.5 MediumgrafanaSUSEApache Thrift: c_glib dispatch stack overflow5.3 MediumgrafanaSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 HighgrafanaSUSESecurity update for python-pyOpenSSLNo scoregrafanaSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 MediumgrafanaSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 LowgrafanaSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 HighgrafanaSUSEpip doesn't reject concatenated ZIP and tar archives4.6 MediumgrafanaSUSEGrafana Alerting Editors can edit destination of webhooks they did not create1.3 LowgrafanaSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 HighgrafanaSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 CriticalgrafanaSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 MediumgrafanaSUSEBase64 decoding stops at first padded quad by default6.0 MediumgrafanaSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 MediumgrafanaSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 MediumgrafanaSUSEGo JOSE affect by a panic in JWE decryption7.5 HighgrafanaSUSEQuery resampling can cause unbounded memory allocations6.5 MediumgrafanaSUSEGrafana Testdata datasource can issue unbounded memory allocations6.5 MediumgrafanaSUSERCE on Grafana via sqlExpressions9.1 CriticalgrafanaSUSEPublic dashboards discloses all direct mode datasources6.5 MediumgrafanaSUSEMissing Protected-field Authorization in Provisioning Contact Points API5.4 MediumgrafanaSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 CriticalgrafanaSUSEpkgutil.get_data() does not enforce documented restrictions0.0 NonegrafanaSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 HighgrafanaSUSEAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 LowgrafanaSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 HighgrafanaSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 LowgrafanaSUSEfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity1.7 LowgrafanaSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 MediumgrafanaSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 MediumgrafanaSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 CriticalgrafanaSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 CriticalgrafanaSUSELimited path traversal when installing wheel archives2.0 LowgrafanaSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 CriticalgrafanaSUSEDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 HighgrafanaSUSEUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 HighgrafanaSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 MediumgrafanaSUSEReact Router has Path Traversal in File Session Storage9.1 CriticalgrafanaSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 HighgrafanaSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 HighgrafanaSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 HighgrafanaSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 MediumgrafanaSUSEExcessive read buffering DoS in http.client6.3 MediumgrafanaSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 High- Show moreLoading…