grafana vulnerabilities (openSUSE)
145 vulnerabilities.
-
grafanaopenSUSE OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 6.0 Medium -
grafanaopenSUSE CVE-2026-15815 CVE Record 8.8 High -
grafanaopenSUSE CVE-2026-76154 CVE Record 7.3 High -
grafanaopenSUSE Uncontrolled Memory Allocation in cel-go 6.9 Medium -
grafanaopenSUSE gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers 8.7 High -
grafanaopenSUSE Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 7.5 High -
grafanaopenSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
grafanaopenSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
grafanaopenSUSE gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation 8.7 High -
grafanaopenSUSE gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion 6.3 Medium -
grafanaopenSUSE Broken access control in dashboard snapshots 6.3 Medium -
grafanaopenSUSE CVE-2026-17033 CVE Record 6.8 Medium -
grafanaopenSUSE CVE-2026-17183 CVE Record 7.1 High -
grafanaopenSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
grafanaopenSUSE CVE-2026-21723 Record 5.3 Medium -
grafanaopenSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
grafanaopenSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
grafanaopenSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
grafanaopenSUSE Denial of service via unbounded request body size 7.5 High -
grafanaopenSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
grafanaopenSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
grafanaopenSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
grafanaopenSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
grafanaopenSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
grafanaopenSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
grafanaopenSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
grafanaopenSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
grafanaopenSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
grafanaopenSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
grafanaopenSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
grafanaopenSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
grafanaopenSUSE SQL Expressions Read File From Disk 6.3 Medium -
grafanaopenSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
grafanaopenSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
grafanaopenSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
grafanaopenSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium -
grafanaopenSUSE Viewer-triggered race condition in Grafana Live leads to complete server crash 6.5 Medium -
grafanaopenSUSE Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net 7.5 High -
grafanaopenSUSE Apache Thrift: C++ JSON OOB read 6.5 Medium -
grafanaopenSUSE Apache Thrift: c_glib dispatch stack overflow 5.3 Medium -
grafanaopenSUSE Apache Thrift: Go TFramedTransport uint32 overflow 7.5 High -
grafanaopenSUSE Grafana Alerting Editors can edit destination of webhooks they did not create 1.3 Low -
grafanaopenSUSE OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies 5.3 Medium -
grafanaopenSUSE Go JOSE affect by a panic in JWE decryption 7.5 High -
grafanaopenSUSE Query resampling can cause unbounded memory allocations 6.5 Medium -
grafanaopenSUSE Grafana Testdata datasource can issue unbounded memory allocations 6.5 Medium -
grafanaopenSUSE RCE on Grafana via sqlExpressions 9.1 Critical -
grafanaopenSUSE Public dashboards discloses all direct mode datasources 6.5 Medium -
grafanaopenSUSE Missing Protected-field Authorization in Provisioning Contact Points API 5.4 Medium -
grafanaopenSUSE Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS 6.5 Medium - Show olderLoading…