SUSE-SU-2026:3718-1
Vulnerability from csaf_suse - Published: 2026-08-24 09:23 - Updated: 2026-09-15 16:10Summary
Security update for grafana
Severity
Important
Notes
Title of the patch: Security update for grafana
Description of the patch: This update for grafana fixes the following issues:
grafana updated from version 11.6.14+security04 to version 12.4.5:
Security fixes:
- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)
Breaking chahnges introduced in version 12.0.0:
- BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.
Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):
- Add Legal-Review-Notice (bsc#1271327)
- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
- Analytics: Keep internal dashboard id.
- Reporting: Correctly apply appSubURL to report settings requests
- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
- Dependency updates to core plugins and UI libraries.
- Updates to data source provisioning and dashboard schemas.
- Introduced dynamic dashboards in public preview.
- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
- Added the ability to create dashboards from templates using sample data.
- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
- Added support to map one variable to multiple values.
- Released a completely redesigned logs visualization.
- Added the ability to export dashboards directly as PNG images.
- Introduced an interactive learning experience within the Grafana UI.
- Added a Switch template variable type to quickly toggle between values in queries.
- Added functionality to style table cells using CSS properties via the field cell option.
- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
- Redesigned the alert rule list page.
- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
- Added support for Service Account Impersonation in the BigQuery data source.
- Introduced the Grafana Advisor in public preview.
- Introduced a new dashboard schema to replace the original single grid layout.
- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
Patchnames: SUSE-2026-3718,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3718
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
4.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
low
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
7.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
7.7 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-12141
Threats
Impact
important
References
88 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana fixes the following issues:\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3718,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3718",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3718-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3718-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263718-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3718-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028485.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262187",
"url": "https://bugzilla.suse.com/1262187"
},
{
"category": "self",
"summary": "SUSE Bug 1263272",
"url": "https://bugzilla.suse.com/1263272"
},
{
"category": "self",
"summary": "SUSE Bug 1264764",
"url": "https://bugzilla.suse.com/1264764"
},
{
"category": "self",
"summary": "SUSE Bug 1265281",
"url": "https://bugzilla.suse.com/1265281"
},
{
"category": "self",
"summary": "SUSE Bug 1265282",
"url": "https://bugzilla.suse.com/1265282"
},
{
"category": "self",
"summary": "SUSE Bug 1265283",
"url": "https://bugzilla.suse.com/1265283"
},
{
"category": "self",
"summary": "SUSE Bug 1265284",
"url": "https://bugzilla.suse.com/1265284"
},
{
"category": "self",
"summary": "SUSE Bug 1265285",
"url": "https://bugzilla.suse.com/1265285"
},
{
"category": "self",
"summary": "SUSE Bug 1265286",
"url": "https://bugzilla.suse.com/1265286"
},
{
"category": "self",
"summary": "SUSE Bug 1265287",
"url": "https://bugzilla.suse.com/1265287"
},
{
"category": "self",
"summary": "SUSE Bug 1265288",
"url": "https://bugzilla.suse.com/1265288"
},
{
"category": "self",
"summary": "SUSE Bug 1265289",
"url": "https://bugzilla.suse.com/1265289"
},
{
"category": "self",
"summary": "SUSE Bug 1265290",
"url": "https://bugzilla.suse.com/1265290"
},
{
"category": "self",
"summary": "SUSE Bug 1266600",
"url": "https://bugzilla.suse.com/1266600"
},
{
"category": "self",
"summary": "SUSE Bug 1267153",
"url": "https://bugzilla.suse.com/1267153"
},
{
"category": "self",
"summary": "SUSE Bug 1271327",
"url": "https://bugzilla.suse.com/1271327"
},
{
"category": "self",
"summary": "SUSE Bug 1271331",
"url": "https://bugzilla.suse.com/1271331"
},
{
"category": "self",
"summary": "SUSE Bug 1274217",
"url": "https://bugzilla.suse.com/1274217"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-12141 page",
"url": "https://www.suse.com/security/cve/CVE-2025-12141/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-30153 page",
"url": "https://www.suse.com/security/cve/CVE-2025-30153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-21725 page",
"url": "https://www.suse.com/security/cve/CVE-2026-21725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-28374 page",
"url": "https://www.suse.com/security/cve/CVE-2026-28374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-28376 page",
"url": "https://www.suse.com/security/cve/CVE-2026-28376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-28379 page",
"url": "https://www.suse.com/security/cve/CVE-2026-28379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-28380 page",
"url": "https://www.suse.com/security/cve/CVE-2026-28380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-28383 page",
"url": "https://www.suse.com/security/cve/CVE-2026-28383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33376 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33377 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33378 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33380 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33381 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33382 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39882 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39882/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41607 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41607/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
}
],
"title": "Security update for grafana",
"tracking": {
"current_release_date": "2026-09-15T16:10:58Z",
"generator": {
"date": "2026-08-24T09:23:40Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3718-1",
"initial_release_date": "2026-08-24T09:23:40Z",
"revision_history": [
{
"date": "2026-08-24T09:23:40Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-08-24T09:23:40Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-15T16:10:58Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-12.4.5-150200.3.91.1.aarch64",
"product": {
"name": "grafana-12.4.5-150200.3.91.1.aarch64",
"product_id": "grafana-12.4.5-150200.3.91.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-12.4.5-150200.3.91.1.ppc64le",
"product": {
"name": "grafana-12.4.5-150200.3.91.1.ppc64le",
"product_id": "grafana-12.4.5-150200.3.91.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-12.4.5-150200.3.91.1.s390x",
"product": {
"name": "grafana-12.4.5-150200.3.91.1.s390x",
"product_id": "grafana-12.4.5-150200.3.91.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-12.4.5-150200.3.91.1.x86_64",
"product": {
"name": "grafana-12.4.5-150200.3.91.1.x86_64",
"product_id": "grafana-12.4.5-150200.3.91.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-12.4.5-150200.3.91.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64"
},
"product_reference": "grafana-12.4.5-150200.3.91.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-12.4.5-150200.3.91.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le"
},
"product_reference": "grafana-12.4.5-150200.3.91.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-12.4.5-150200.3.91.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x"
},
"product_reference": "grafana-12.4.5-150200.3.91.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-12.4.5-150200.3.91.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
},
"product_reference": "grafana-12.4.5-150200.3.91.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-12141",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-12141"
}
],
"notes": [
{
"category": "general",
"text": "In Grafana\u0027s alerting system, users with edit permissions for a contact point, specifically the permissions \"alert.notifications:write\" or \"alert.notifications.receivers:test\" that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-12141",
"url": "https://www.suse.com/security/cve/CVE-2025-12141"
},
{
"category": "external",
"summary": "SUSE Bug 1262187 for CVE-2025-12141",
"url": "https://bugzilla.suse.com/1262187"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2025-12141"
},
{
"cve": "CVE-2025-30153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-30153"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-30153",
"url": "https://www.suse.com/security/cve/CVE-2025-30153"
},
{
"category": "external",
"summary": "SUSE Bug 1264761 for CVE-2025-30153",
"url": "https://bugzilla.suse.com/1264761"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2025-30153"
},
{
"cve": "CVE-2026-21725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-21725"
}
],
"notes": [
{
"category": "general",
"text": "A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.\n\nThis requires several very stringent conditions to be met:\n\n- The attacker must have admin access to the specific datasource prior to its first deletion.\n- Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana.\n- The attacker must delete the datasource, then someone must recreate it.\n- The new datasource must not have the attacker as an admin.\n- The new datasource must have the same UID as the prior datasource. These are randomised by default.\n- The datasource can now be re-deleted by the attacker.\n- Once 30 seconds are up, the attack is spent and cannot be repeated.\n- No datasource with any other UID can be attacked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-21725",
"url": "https://www.suse.com/security/cve/CVE-2026-21725"
},
{
"category": "external",
"summary": "SUSE Bug 1258873 for CVE-2026-21725",
"url": "https://bugzilla.suse.com/1258873"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "low"
}
],
"title": "CVE-2026-21725"
},
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-28374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-28374"
}
],
"notes": [
{
"category": "general",
"text": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-28374",
"url": "https://www.suse.com/security/cve/CVE-2026-28374"
},
{
"category": "external",
"summary": "SUSE Bug 1265290 for CVE-2026-28374",
"url": "https://bugzilla.suse.com/1265290"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-28374"
},
{
"cve": "CVE-2026-28376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-28376"
}
],
"notes": [
{
"category": "general",
"text": "The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-28376",
"url": "https://www.suse.com/security/cve/CVE-2026-28376"
},
{
"category": "external",
"summary": "SUSE Bug 1265289 for CVE-2026-28376",
"url": "https://bugzilla.suse.com/1265289"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-28376"
},
{
"cve": "CVE-2026-28379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-28379"
}
],
"notes": [
{
"category": "general",
"text": "A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-28379",
"url": "https://www.suse.com/security/cve/CVE-2026-28379"
},
{
"category": "external",
"summary": "SUSE Bug 1265288 for CVE-2026-28379",
"url": "https://bugzilla.suse.com/1265288"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-28379"
},
{
"cve": "CVE-2026-28380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-28380"
}
],
"notes": [
{
"category": "general",
"text": "Any Editor could delete any snapshot, even if they have no access to read or write them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-28380",
"url": "https://www.suse.com/security/cve/CVE-2026-28380"
},
{
"category": "external",
"summary": "SUSE Bug 1265287 for CVE-2026-28380",
"url": "https://bugzilla.suse.com/1265287"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-28380"
},
{
"cve": "CVE-2026-28383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-28383"
}
],
"notes": [
{
"category": "general",
"text": "A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-28383",
"url": "https://www.suse.com/security/cve/CVE-2026-28383"
},
{
"category": "external",
"summary": "SUSE Bug 1265286 for CVE-2026-28383",
"url": "https://bugzilla.suse.com/1265286"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-28383"
},
{
"cve": "CVE-2026-33376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33376"
}
],
"notes": [
{
"category": "general",
"text": "When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33376",
"url": "https://www.suse.com/security/cve/CVE-2026-33376"
},
{
"category": "external",
"summary": "SUSE Bug 1265285 for CVE-2026-33376",
"url": "https://bugzilla.suse.com/1265285"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-33376"
},
{
"cve": "CVE-2026-33377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33377"
}
],
"notes": [
{
"category": "general",
"text": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33377",
"url": "https://www.suse.com/security/cve/CVE-2026-33377"
},
{
"category": "external",
"summary": "SUSE Bug 1265284 for CVE-2026-33377",
"url": "https://bugzilla.suse.com/1265284"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-33377"
},
{
"cve": "CVE-2026-33378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33378"
}
],
"notes": [
{
"category": "general",
"text": "Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33378",
"url": "https://www.suse.com/security/cve/CVE-2026-33378"
},
{
"category": "external",
"summary": "SUSE Bug 1265283 for CVE-2026-33378",
"url": "https://bugzilla.suse.com/1265283"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-33378"
},
{
"cve": "CVE-2026-33380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33380"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server\u0027s filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33380",
"url": "https://www.suse.com/security/cve/CVE-2026-33380"
},
{
"category": "external",
"summary": "SUSE Bug 1265282 for CVE-2026-33380",
"url": "https://bugzilla.suse.com/1265282"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-33380"
},
{
"cve": "CVE-2026-33381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33381"
}
],
"notes": [
{
"category": "general",
"text": "When a user\u0027s access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33381",
"url": "https://www.suse.com/security/cve/CVE-2026-33381"
},
{
"category": "external",
"summary": "SUSE Bug 1265281 for CVE-2026-33381",
"url": "https://bugzilla.suse.com/1265281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-33381"
},
{
"cve": "CVE-2026-33382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33382"
}
],
"notes": [
{
"category": "general",
"text": "Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33382",
"url": "https://www.suse.com/security/cve/CVE-2026-33382"
},
{
"category": "external",
"summary": "SUSE Bug 1271331 for CVE-2026-33382",
"url": "https://bugzilla.suse.com/1271331"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-33382"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39882",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39882"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39882",
"url": "https://www.suse.com/security/cve/CVE-2026-39882"
},
{
"category": "external",
"summary": "SUSE Bug 1274212 for CVE-2026-39882",
"url": "https://bugzilla.suse.com/1274212"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-39882"
},
{
"cve": "CVE-2026-41607",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41607"
}
],
"notes": [
{
"category": "general",
"text": "Out-of-bounds Read vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41607",
"url": "https://www.suse.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "SUSE Bug 1263256 for CVE-2026-41607",
"url": "https://bugzilla.suse.com/1263256"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-41607"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-12.4.5-150200.3.91.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-24T09:23:40Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…