SUSE-SU-2026:4600-1
Vulnerability from csaf_suse - Published: 2026-10-09 08:54 - Updated: 2026-10-09 18:04Summary
Security update for grafana, system-user-grafana
Severity
Important
Notes
Title of the patch: Security update for grafana, system-user-grafana
Description of the patch: This update for grafana, system-user-grafana fixes the following issues:
- Update to version 12.4.10:
* Security:
CVE-2026-17183: Fix exposing data accessible through Grafana's
configured datasource credentials (bsc#1275934)
CVE-2026-2303: Drop dependency on vulnerable
go.mongodb.org/mongo-driver (bsc#1269841)
CVE-2026-17033: Fix stored XSS via external Alertmanager
generatorURL (bsc#1276426)
CVE-2026-73501: Fix fail-open authentication bypass in
github.com/getkin/kin-openapi (bsc#1276973)
CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
CVE-2026-14199: Fix session takeover via Auth Proxy cache key
collision (bsc#1278322)
* Bug fixes:
Dashboards: Fix adhoc and groupby variable datasource on UI
import
Dashboards: Fix version dates and user display names in the
legacy version history page
- Update to version 12.4.9:
* Features and enhancements:
Dashboard Import: Labels in v2 schema
* Bug fixes:
Azure Monitor: fix migration for dimension filters
- Update to version 12.4.8:
* Security:
CVE-2026-19197: Fix access control in dashboard snapshots
(bsc#1277025)
- Update to version 12.4.7:
* Security:
CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8
input in golang.org/x/text/unicode/norm
(bsc#1272008)
* Features and enhancements:
Dashboards: Get annotations and dashboard endpoint performance
improvements
* Bug fixes:
DashboardDS: Fix Mixed panels with a time override stuck in
permanent loading
- Update to version 12.4.6:
* Security:
CVE-2026-41178: Fix opentelemetry-go's baggage parsing
(bsc#1276658)
* Features and enhancements:
Alerting: Add protected fields authorization check to
provisioning API
Alerting: Return 403 instead of 500 on contact point provenance
mismatch
* Bug fixes:
Jaeger: Handle gzip, deflate, and brotli compressed API
responses
Alerting: fix ORM table mapping bug causing SELECT alert_rule
columns FROM user on PostgreSQL
- Drop 0005-Bump-edwards25519.patch
CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry
OTLP HTTP exporters by updating to v1.43.0.
(bsc#1274217)
CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)
CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a
public dashboard query endpoint (bsc#1268868)
CVE-2026-9029: Fix arbitrary code execution and information
disclosure via XSS in geomap panel (bsc#1272328)
CVE-2026-33814: Fix infinite loop in HTTP/2 transport by
updating golang.org/x/net (bsc#1265763)
CVE-2026-8609: Fix pre-authentication DoS in the OAuth login
route (bsc#1271330)
* CVE-2026-1229: Update github.com/cloudflare/circl to fix
producing incorect output for specific inputs
(bsc#1265525)
(bsc#1262187)
* CVE-2026-21723: Fix DoS vulnerability in Templates Test
endpoint (bsc#1272427)
- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)
- Build only for SUSE distributions
Patchnames: SUSE-2026-4600,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4600
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
7.1 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
important
6.8 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
important
6.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
5 products, the same list as for
CVE-2026-1229
Threats
Impact
moderate
References
79 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana, system-user-grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana, system-user-grafana fixes the following issues:\n\n- Update to version 12.4.10:\n * Security:\n CVE-2026-17183: Fix exposing data accessible through Grafana\u0027s\n configured datasource credentials (bsc#1275934)\n CVE-2026-2303: Drop dependency on vulnerable\n go.mongodb.org/mongo-driver (bsc#1269841)\n CVE-2026-17033: Fix stored XSS via external Alertmanager\n generatorURL (bsc#1276426)\n CVE-2026-73501: Fix fail-open authentication bypass in\n github.com/getkin/kin-openapi (bsc#1276973)\n CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)\n CVE-2026-14199: Fix session takeover via Auth Proxy cache key\n collision (bsc#1278322)\n * Bug fixes:\n Dashboards: Fix adhoc and groupby variable datasource on UI\n import\n Dashboards: Fix version dates and user display names in the\n legacy version history page\n- Update to version 12.4.9:\n * Features and enhancements:\n Dashboard Import: Labels in v2 schema\n * Bug fixes:\n Azure Monitor: fix migration for dimension filters\n- Update to version 12.4.8:\n * Security:\n CVE-2026-19197: Fix access control in dashboard snapshots\n (bsc#1277025)\n- Update to version 12.4.7:\n * Security:\n CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8\n input in golang.org/x/text/unicode/norm\n (bsc#1272008)\n * Features and enhancements:\n Dashboards: Get annotations and dashboard endpoint performance\n improvements\n * Bug fixes:\n DashboardDS: Fix Mixed panels with a time override stuck in\n permanent loading\n- Update to version 12.4.6:\n * Security:\n CVE-2026-41178: Fix opentelemetry-go\u0027s baggage parsing\n (bsc#1276658)\n * Features and enhancements:\n Alerting: Add protected fields authorization check to\n provisioning API\n Alerting: Return 403 instead of 500 on contact point provenance\n mismatch\n * Bug fixes:\n Jaeger: Handle gzip, deflate, and brotli compressed API\n responses\n Alerting: fix ORM table mapping bug causing SELECT alert_rule\n columns FROM user on PostgreSQL\n- Drop 0005-Bump-edwards25519.patch\n\n CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry\n OTLP HTTP exporters by updating to v1.43.0.\n (bsc#1274217)\n CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557)\n CVE-2026-42127: Fix DoS through memory exhaustion in grafana\u0027a\n public dashboard query endpoint (bsc#1268868)\n CVE-2026-9029: Fix arbitrary code execution and information\n disclosure via XSS in geomap panel (bsc#1272328)\n CVE-2026-33814: Fix infinite loop in HTTP/2 transport by\n updating golang.org/x/net (bsc#1265763)\n CVE-2026-8609: Fix pre-authentication DoS in the OAuth login\n route (bsc#1271330)\n * CVE-2026-1229: Update github.com/cloudflare/circl to fix\n producing incorect output for specific inputs\n (bsc#1265525)\n (bsc#1262187)\n * CVE-2026-21723: Fix DoS vulnerability in Templates Test\n endpoint (bsc#1272427)\n- CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)\n- Build only for SUSE distributions\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-4600,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4600",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4600-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:4600-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264600-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:4600-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264600-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1262187",
"url": "https://bugzilla.suse.com/1262187"
},
{
"category": "self",
"summary": "SUSE Bug 1263330",
"url": "https://bugzilla.suse.com/1263330"
},
{
"category": "self",
"summary": "SUSE Bug 1265525",
"url": "https://bugzilla.suse.com/1265525"
},
{
"category": "self",
"summary": "SUSE Bug 1265763",
"url": "https://bugzilla.suse.com/1265763"
},
{
"category": "self",
"summary": "SUSE Bug 1268868",
"url": "https://bugzilla.suse.com/1268868"
},
{
"category": "self",
"summary": "SUSE Bug 1269841",
"url": "https://bugzilla.suse.com/1269841"
},
{
"category": "self",
"summary": "SUSE Bug 1271330",
"url": "https://bugzilla.suse.com/1271330"
},
{
"category": "self",
"summary": "SUSE Bug 1271557",
"url": "https://bugzilla.suse.com/1271557"
},
{
"category": "self",
"summary": "SUSE Bug 1272008",
"url": "https://bugzilla.suse.com/1272008"
},
{
"category": "self",
"summary": "SUSE Bug 1272328",
"url": "https://bugzilla.suse.com/1272328"
},
{
"category": "self",
"summary": "SUSE Bug 1272427",
"url": "https://bugzilla.suse.com/1272427"
},
{
"category": "self",
"summary": "SUSE Bug 1274217",
"url": "https://bugzilla.suse.com/1274217"
},
{
"category": "self",
"summary": "SUSE Bug 1275934",
"url": "https://bugzilla.suse.com/1275934"
},
{
"category": "self",
"summary": "SUSE Bug 1276426",
"url": "https://bugzilla.suse.com/1276426"
},
{
"category": "self",
"summary": "SUSE Bug 1276658",
"url": "https://bugzilla.suse.com/1276658"
},
{
"category": "self",
"summary": "SUSE Bug 1276973",
"url": "https://bugzilla.suse.com/1276973"
},
{
"category": "self",
"summary": "SUSE Bug 1277025",
"url": "https://bugzilla.suse.com/1277025"
},
{
"category": "self",
"summary": "SUSE Bug 1278307",
"url": "https://bugzilla.suse.com/1278307"
},
{
"category": "self",
"summary": "SUSE Bug 1278322",
"url": "https://bugzilla.suse.com/1278322"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-1229 page",
"url": "https://www.suse.com/security/cve/CVE-2026-1229/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-14199 page",
"url": "https://www.suse.com/security/cve/CVE-2026-14199/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17033 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17033/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-17183 page",
"url": "https://www.suse.com/security/cve/CVE-2026-17183/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-19197 page",
"url": "https://www.suse.com/security/cve/CVE-2026-19197/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-19475 page",
"url": "https://www.suse.com/security/cve/CVE-2026-19475/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-21723 page",
"url": "https://www.suse.com/security/cve/CVE-2026-21723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-2303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-2303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39882 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39882/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41178 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41178/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41606 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41606/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42127 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42127/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-73501 page",
"url": "https://www.suse.com/security/cve/CVE-2026-73501/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8609 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8609/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9029 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9029/"
}
],
"title": "Security update for grafana, system-user-grafana",
"tracking": {
"current_release_date": "2026-10-09T18:04:10Z",
"generator": {
"date": "2026-10-09T08:54:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:4600-1",
"initial_release_date": "2026-10-09T08:54:30Z",
"revision_history": [
{
"date": "2026-10-09T08:54:30Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-09T18:04:10Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:12.4.10-150200.3.94.3.aarch64",
"product": {
"name": "grafana-0:12.4.10-150200.3.94.3.aarch64",
"product_id": "grafana-0:12.4.10-150200.3.94.3.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:grafana:grafana:12.4.10:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/grafana@12.4.10-150200.3.94.3?arch=aarch64\u0026upstream=grafana-0:12.4.10-150200.3.94.3.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "system-user-grafana-0:1.0.0-150200.5.8.1.noarch",
"product": {
"name": "system-user-grafana-0:1.0.0-150200.5.8.1.noarch",
"product_id": "system-user-grafana-0:1.0.0-150200.5.8.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/system-user-grafana@1.0.0-150200.5.8.1?arch=noarch\u0026upstream=system-user-grafana-0:1.0.0-150200.5.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:12.4.10-150200.3.94.3.ppc64le",
"product": {
"name": "grafana-0:12.4.10-150200.3.94.3.ppc64le",
"product_id": "grafana-0:12.4.10-150200.3.94.3.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:grafana:grafana:12.4.10:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/grafana@12.4.10-150200.3.94.3?arch=ppc64le\u0026upstream=grafana-0:12.4.10-150200.3.94.3.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:12.4.10-150200.3.94.3.s390x",
"product": {
"name": "grafana-0:12.4.10-150200.3.94.3.s390x",
"product_id": "grafana-0:12.4.10-150200.3.94.3.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:grafana:grafana:12.4.10:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/grafana@12.4.10-150200.3.94.3?arch=s390x\u0026upstream=grafana-0:12.4.10-150200.3.94.3.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:12.4.10-150200.3.94.3.x86_64",
"product": {
"name": "grafana-0:12.4.10-150200.3.94.3.x86_64",
"product_id": "grafana-0:12.4.10-150200.3.94.3.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:grafana:grafana:12.4.10:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/grafana@12.4.10-150200.3.94.3?arch=x86_64\u0026upstream=grafana-0:12.4.10-150200.3.94.3.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:12.4.10-150200.3.94.3.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64"
},
"product_reference": "grafana-0:12.4.10-150200.3.94.3.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:12.4.10-150200.3.94.3.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le"
},
"product_reference": "grafana-0:12.4.10-150200.3.94.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:12.4.10-150200.3.94.3.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x"
},
"product_reference": "grafana-0:12.4.10-150200.3.94.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:12.4.10-150200.3.94.3.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64"
},
"product_reference": "grafana-0:12.4.10-150200.3.94.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "system-user-grafana-0:1.0.0-150200.5.8.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
},
"product_reference": "system-user-grafana-0:1.0.0-150200.5.8.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-1229",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-1229"
}
],
"notes": [
{
"category": "general",
"text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-1229",
"url": "https://www.suse.com/security/cve/CVE-2026-1229"
},
{
"category": "external",
"summary": "SUSE Bug 1265416 for CVE-2026-1229",
"url": "https://bugzilla.suse.com/1265416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-1229"
},
{
"cve": "CVE-2026-14199",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-14199"
}
],
"notes": [
{
"category": "general",
"text": "Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user\u0027s, while that user\u0027s cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-14199",
"url": "https://www.suse.com/security/cve/CVE-2026-14199"
},
{
"category": "external",
"summary": "SUSE Bug 1278322 for CVE-2026-14199",
"url": "https://bugzilla.suse.com/1278322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-14199"
},
{
"cve": "CVE-2026-17033",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17033"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user\u0027s Grafana session.\n\nGrafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor\u0027s :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user\u0027s permissions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17033",
"url": "https://www.suse.com/security/cve/CVE-2026-17033"
},
{
"category": "external",
"summary": "SUSE Bug 1276426 for CVE-2026-17033",
"url": "https://bugzilla.suse.com/1276426"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-17033"
},
{
"cve": "CVE-2026-17183",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-17183"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana\u0027s configured datasource credentials to users who lack permission to query that datasource.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-17183",
"url": "https://www.suse.com/security/cve/CVE-2026-17183"
},
{
"category": "external",
"summary": "SUSE Bug 1275934 for CVE-2026-17183",
"url": "https://bugzilla.suse.com/1275934"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-17183"
},
{
"cve": "CVE-2026-19197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-19197"
}
],
"notes": [
{
"category": "general",
"text": "A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot\u0027s secret delete key using only its public share key (broken access control).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-19197",
"url": "https://www.suse.com/security/cve/CVE-2026-19197"
},
{
"category": "external",
"summary": "SUSE Bug 1277025 for CVE-2026-19197",
"url": "https://bugzilla.suse.com/1277025"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-19197"
},
{
"cve": "CVE-2026-19475",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-19475"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana\u0027s regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-19475",
"url": "https://www.suse.com/security/cve/CVE-2026-19475"
},
{
"category": "external",
"summary": "SUSE Bug 1278307 for CVE-2026-19475",
"url": "https://bugzilla.suse.com/1278307"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-19475"
},
{
"cve": "CVE-2026-21723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-21723"
}
],
"notes": [
{
"category": "general",
"text": "The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-21723",
"url": "https://www.suse.com/security/cve/CVE-2026-21723"
},
{
"category": "external",
"summary": "SUSE Bug 1272427 for CVE-2026-21723",
"url": "https://bugzilla.suse.com/1272427"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-21723"
},
{
"cve": "CVE-2026-2303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-2303"
}
],
"notes": [
{
"category": "general",
"text": "The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-2303",
"url": "https://www.suse.com/security/cve/CVE-2026-2303"
},
{
"category": "external",
"summary": "SUSE Bug 1268652 for CVE-2026-2303",
"url": "https://bugzilla.suse.com/1268652"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-2303"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39882",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39882"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39882",
"url": "https://www.suse.com/security/cve/CVE-2026-39882"
},
{
"category": "external",
"summary": "SUSE Bug 1274212 for CVE-2026-39882",
"url": "https://bugzilla.suse.com/1274212"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-39882"
},
{
"cve": "CVE-2026-41178",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41178"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41178",
"url": "https://www.suse.com/security/cve/CVE-2026-41178"
},
{
"category": "external",
"summary": "SUSE Bug 1276509 for CVE-2026-41178",
"url": "https://bugzilla.suse.com/1276509"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-41178"
},
{
"cve": "CVE-2026-41606",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41606"
}
],
"notes": [
{
"category": "general",
"text": "Uncontrolled Recursion vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41606",
"url": "https://www.suse.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "SUSE Bug 1263323 for CVE-2026-41606",
"url": "https://bugzilla.suse.com/1263323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-41606"
},
{
"cve": "CVE-2026-42127",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42127"
}
],
"notes": [
{
"category": "general",
"text": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42127",
"url": "https://www.suse.com/security/cve/CVE-2026-42127"
},
{
"category": "external",
"summary": "SUSE Bug 1268868 for CVE-2026-42127",
"url": "https://bugzilla.suse.com/1268868"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-42127"
},
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
},
{
"cve": "CVE-2026-73501",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-73501"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-73501",
"url": "https://www.suse.com/security/cve/CVE-2026-73501"
},
{
"category": "external",
"summary": "SUSE Bug 1276972 for CVE-2026-73501",
"url": "https://bugzilla.suse.com/1276972"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "important"
}
],
"title": "CVE-2026-73501"
},
{
"cve": "CVE-2026-8595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8595"
}
],
"notes": [
{
"category": "general",
"text": "A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8595",
"url": "https://www.suse.com/security/cve/CVE-2026-8595"
},
{
"category": "external",
"summary": "SUSE Bug 1271557 for CVE-2026-8595",
"url": "https://bugzilla.suse.com/1271557"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-8595"
},
{
"cve": "CVE-2026-8609",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8609"
}
],
"notes": [
{
"category": "general",
"text": "An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8609",
"url": "https://www.suse.com/security/cve/CVE-2026-8609"
},
{
"category": "external",
"summary": "SUSE Bug 1271330 for CVE-2026-8609",
"url": "https://bugzilla.suse.com/1271330"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-8609"
},
{
"cve": "CVE-2026-9029",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9029"
}
],
"notes": [
{
"category": "general",
"text": "A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel\u0027s XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9029",
"url": "https://www.suse.com/security/cve/CVE-2026-9029"
},
{
"category": "external",
"summary": "SUSE Bug 1272328 for CVE-2026-9029",
"url": "https://bugzilla.suse.com/1272328"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-0:12.4.10-150200.3.94.3.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:system-user-grafana-0:1.0.0-150200.5.8.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T08:54:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-9029"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…