p PatchFirst

PatchFirst · Latest vulnerabilities

grafana vulnerabilities

Vulnerability published for grafana in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 5

  1. openSUSE-SU-2026:22125-1

    Not ratedFix available

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: Update to version 12.4.10: * Security: * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) * CVE-2026-14199: Fix session takeover via Auth Proxy c

    grafanaOperating systems Applications
    • Update to 12.4.10-bp160.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. openSUSE-SU-2026:21366-1

    Not ratedFix available

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331) - CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)

    grafanaOperating systems Applications
    • Update to 12.4.5-bp160.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. openSUSE-SU-2026:21351-1

    Not ratedFix available

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: - Add UI web assets as additional source tarball - Update to version 12.4.5 (jsc#PED-16512): * Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid - Update to version 12.4.4: * Security and quality updates. * Various bug fixes and enhancements. - Update to version 12.4.3: * Analytics: Keep internal dashboard id. * Go: Update to 1.25.9. * Reporting: Correctly apply appSubURL to report settings requests. * Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.

    grafanaOperating systems Applications
    • Update to 12.4.5-bp160.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. openSUSE-SU-2026:20940-1

    Not ratedFix available

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600) - Update to version 11.6.14+security-04: Security: * CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290) * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289) * CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286) * CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287) * CVE-2026-33376: Fi

    grafanaOperating systems Applications
    • Update to 11.6.14+security04-bp160.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →