{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "etcd-for-k8s1.32-3.5.24-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the etcd-for-k8s1.32-3.5.24-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15764",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15764-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20329 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20329/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      }
    ],
    "title": "etcd-for-k8s1.32-3.5.24-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-11-25T00:00:00Z",
      "generator": {
        "date": "2025-11-25T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15764-1",
      "initial_release_date": "2025-11-25T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-11-25T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20329",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20329"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20329",
          "url": "https://www.suse.com/security/cve/CVE-2021-20329"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20329"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for grafana",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- Update to version 11.6.11:\n  Features and enhancements:\n  * Alerting: Add limits for the size of expanded notification\n    templates\n  * Correlations: Remove support for org_id=0\n  Security:\n  * CVE-2026-21722: Public dashboards annotations: use dashboard\n    timerange if time selection disabled (bsc#1258136)\n\n- Update to version 11.6.10:\n  Features and enhancements:\n  * API: Add missing scope check on dashboards\n  * Avatar: Require sign-in, remove queue, respect timeout\n  Bug fixes:\n  * Alerting: Fix a race condition panic in ResetStateByRuleUID\n\n- Update to version 11.6.9:\n  Features and enhancements:\n  * Plugins: Add PluginContext to plugins when scenes is disabled\n  Bug fixes:\n  * Alerting: Fix contacts point issues\n\n- Update to version 11.6.8:\n  Bug fixes:\n  * Alerting: Fix unmarshalling of GettableStatus to include time\n    intervals\n\n- Update to version 11.6.7:\n  Bug fixes:\n  * Auth: Fix render user OAuth passthrough\n  * LDAP Authentication: Fix URL to propagate username context as\n    parameter\n  * Plugins: Dependencies do not inherit parent URL for preinstall\n  * URLParams: Stringify true values as key=true always (fixes\n    issues with variables with true value)\n\n- Update to version 11.6.6:\n  Bug fixes:\n  * Alerting: Fix copying of recording rule fields\n  * Fix redirection after login when Grafana is served from subpath\n\n- Update to version 11.6.5:\n  Features and enhancements:\n  * Alerting: Bump alerting package to include change to\n    NewTLSClient\n\n- Update to version 11.6.4:\n  Features and enhancements:\n  * StateTimeline: Add endTime to tooltip\n  * Unified storage: Respect GF_DATABASE_URL override\n  Bug fixes:\n  * Alerting: Fix group interval override when adding new rules\n  * Azure: Fix legend formatting\n  * Azure: Fix resource name determination in template variable\n    queries\n  * Graphite: Fix annotation queries\n  * Graphite: Fix date mutation\n  * Graphite: Fix nested variable interpolation for repeated rows\n\n- Update to version 11.6.3:\n  Security:\n  * Fixes CVE-2025-3415\n\n- Update to version 11.6.2:\n  Bug fixes:\n  * Dashboard: Fixes issue with row repeats and first row\n  * Graphite: Ensure template variables are interpolated correctly\n  * Graphite: Fix Graphite series interpolation\n  * Prometheus: Fix semver import path\n\n- Update to version 11.6.1:\n  Features and enhancements:\n  * DashboardScenePage: Correct slug in self referencing data links\n  * GrafanaUI: Use safePolygon close handler for interactive\n    tooltips instead of a delay\n  * Prometheus: Add support for cloud partners Prometheus data\n    sources\n  Bug fixes:\n  * Alertmanager: Add Role-Based Access Control via reqAction Field\n  * GrafanaUI: Remove blurred background from overlay backdrops to\n    improve performance\n  * InfluxDB: Fix nested variable interpolation\n  * LDAP test: Fix page crash\n  * Org redirection: Fix linking between orgs\n\n- Upgrade to version 11.6.0:\n  Features and enhancements:\n  * Visualisations: One click links and actions\n  * Annotations: Add cron syntax support\n  * WebGL-powered geomaps for better performance\n  * Alerting: Add alert rule version history\n  Security:\n  * API keys: Migrate API keys to service accounts at startup\n\n- CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)\n- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)\n- CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n- CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)\n\n- Use forked wire from Grafana repository instead of external\n  package (jsc#PED-14178).\n\n- Update to version 11.5.10:\n  Security:\n  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)\n  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)\n  Features and enhancements:\n  * Update to Go 1.25\n  * Update to golang.org/x/net v0.45.0\n  Bug fixes:\n  * Auth: Fix render user OAuth passthrough.\n  * LDAP Authentication: Fix URL to propagate username context as\n                         parameter.\n  * Plugins: Dependencies do not inherit parent URL for preinstall.\n\n- Update to version 11.5.9:\n  * Security:\n    CVE-2025-11065: Fix sensitive information leak in logs\n                    (bsc#1250616)\n  * Features and enhancements:\n    Auditing: Document new options for recording datasource query\n              request/response body.\n  * Bug fixes:\n    Login: Fix redirection after login when Grafana is served from\n           subpath.\n\n- Update to version 11.5.8:\n  * No relevant changes\n\n- Update to version 11.5.7:\n  * Security:\n    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards (bsc#1246735)\n    CVE-2025-6197: Fix open redirect in organization switching (bsc#1246736)\n  * Bug fixes:\n    Azure: Fix legend formatting.\n    Azure: Fix resource name determination in template variable\n           queries.\n\n- Update to version 11.5.6:\n  * Security:\n    CVE-2025-3415: Fix exposure of DingDing alerting integration\n                   URL to Viewer level users (bsc#1245302)\n\n- Update to version 11.5.5 (jsc#PED-12918):\n  * Security:\n    CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).\n    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)\n    CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).\n\n- Update to version 11.5.4:\n  * Security:\n    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.\n    CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).\n    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).\n  * Features and enhancements:\n    Azure Monitor: Filter namespaces by resource group.\n    Azure: Add support for custom namespace and custom metrics\n           variable queries.\n    Azure: Resource picker improvements.\n    Azure: Support more complex variable interpolation.\n    Azure: Variable editor and resource picker improvements.\n    DashboardScenePage: Correct slug in self referencing data\n                        links.\n    Prometheus: Add support for cloud partners Prometheus data\n                sources.\n  * Bug fixes:\n    InfluxDB: Fix nested variable interpolation.\n    LDAP test: Fix page crash.\n\n- Update to version 11.5.3:\n  * Security:\n    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).\n  * Bug fixes:\n    Alerting: Fix token-based Slack image upload to work with\n              channel names.\n    Auth: Fix AzureAD config UI\u0027s ClientAuthentication dropdown.\n    Dashboard: Fix the unintentional time range and variables\n               updates on saving.\n    Dashboards: Fix missing v/e/i keybindings to return back to\n                dashboard.\n    InfluxDB: Improve handling of template variables contained in\n              regular expressions (InfluxQL).\n    Org redirection: Fix linking between orgs.\n\n- Update to version 11.5.2:\n  * Bug fixes:\n    Alerting: Allow specifying uid for new rules added to groups.\n    Alerting: Call RLock() before reading sendAlertsTo map.\n    Auth: Fix redirect with JWT auth URL login.\n    AuthN: Refetch user on \"ErrUserAlreadyExists\".\n    Azure: Correctly set application insights resource values.\n    DashboardList: Throttle the re-renders.\n    Dashboards: Bring back scripted dashboards.\n    Plugin Metrics: Eliminate data race in plugin metrics\n                    middleware.\n    RBAC: Don\u0027t check folder access if annotationPermissionUpdate\n          FT is enabled.\n\n- Update to version 11.5.1:\n  * Bug fixes:\n    CodeEditor: Fix cursor alignment.\n    TransformationFilter: Include transformation outputs in\n                          transformation filtering options.\n\n- Upgrade to version 11.5.0:\n  * Breaking changes:\n    Loki: Default to /labels API with query param instead of\n          /series API.\n  * Features and enhancements:\n    Extended Cloud Migration Assistent support for plugins and\n      alerts.\n    Redesigned filters for dashboards.\n    New regular expression option for Extract fields\n      transformation.\n    Redesigned sharing experience in Dashboards.\n    Customizable shareable dashboard panel images.\n    RBAC for alerting notifications and notification policies.\n    Add support for Elasticsearch cross-cluster search.\n    Time series macro support in visual query builder for SQL data\n      sources.\n    OAuth and SAML session handling improvements.\n    Plugin Frontend Sandbox for additiona security.\n    Renamed Public dashboards to Shared dashboards.\n\n- Update to version 11.4.1:\n  * Bug fixes:\n    Alerting: AlertingQueryRunner should skip descendant nodes of\n              invalid queries.\n    Alerting: Fix alert rules unpausing after moving rule to\n              different folder.\n    Alerting: Fix label escaping in rule export.\n    Alerting: Fix slack image uploading to use new api.\n    Azure/GCM: Improve error display.\n    Dashboards: Fix issue where filtered panels would not react to\n                variable changes.\n    Dashboards: Fixes issue with panel header showing even when\n                hide time override was enabled.\n    Dashboards: Fixes week relative time ranges when weekStart was\n                changed.\n    Dashboards: Panel react for timeFrom and timeShift changes\n                using variables.\n    DateTimePicker: Fixes issue with date picker showing invalid\n                    date.\n    Fix: Add support for datasource variable queries.\n    InfluxDB: Adhoc filters can use template vars as values.\n    LibraryPanel: Fallback to panel title if library panel title is\n                  not set.\n\n- Upgrade to version 11.4.0:\n  * Features and enhancements:\n    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.\n\n- Update to version 11.3.1:\n  * Features and enhancements:\n    Alerting: Make context deadline on AlertNG service startup\n              configurable.\n    MigrationAssistant: Restrict dashboards, folders and\n                        datasources by the org id of the signed in\n                        user.\n    User: Check SignedInUser OrgID in RevokeInvite.\n  * Bug fixes:\n    Alerting: Fix escaping of silence matchers in utf8 mode.\n    Alerting: Fix overflow for long receiver names.\n    Alerting: Fix saving advanced mode toggle state in the alert\n              rule editor.\n    Alerting: Fix setting datasource uid, when datasource is string\n              in old version.\n    Alerting: Force refetch prom rules when refreshing panel.\n    Anonymous User: Adds validator service for anonymous users.\n    Azure Monitor: Support metric namespaces fallback.\n    Azure: Fix duplicated traces in multi-resource trace query.\n    Azure: Handle namespace request rejection.\n    CloudWatch: Interpolate region in log context query.\n    Dashboard datasource: Return annotations as series when query\n                          topic is \"annotations\".\n    Dashboard: Append orgId to URL.\n    Dashboards: Fixes performance issue expanding a row.\n    Flame Graph: Fix crash when it receives empty data.\n    Folders: Add admin permissions upon creation of a folder w. SA.\n    Folders: Don\u0027t show error pop-up if the user can\u0027t fetch the\n             root folder.\n    Migration: Remove table aliasing in delete statement to make it\n               work for mariadb.\n    ServerLock: Fix pg concurrency/locking issue.\n    Service Accounts: Run service account creation in transaction.\n    Table: Fix text wrapping applying to wrong field.\n    Unified Storage: Use ssl_mode instead of sslmode.\n\n- Update to version 11.3.0+security-01:\n  * Security:\n    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)\n\n- Upgrade to version 11.3.0:\n  * Features and enhancements:\n    View mode and Edit mode are generally available.\n    Template variables and the time range picker remain visible\n      when scrolling.\n    Added timezone parameter in Grafana URL.\n    Kiosk mode displays dashboard controls.\n    Auto-formatted table cell values in Cell Inspect.\n    Allow adding actions to canvas elements.\n    Legend support in bar gauge visualizations.\n    Apply the same binary transformation to all the number fields\n      in a given table at once.\n    Add support for data links and actions in several\n      visualizations.\n    The Explore Logs plugin is installed by default.\n    Added correlations to external URLs in Explore.\n    Simplified query section for alert rule creation.\n    Introduced recording rules for Grafana-managed alerts.\n    GitHub App authentication for the GitHub data source.\n    Improved subfolder creation flow.\n    Redesigned plugin details page.\n    Added UI for LDAP configuration.\n    Added RBAC support in Plugins.\n\n- Update to version 11.2.2+security-01:\n  * Bug fix:\n    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)\n\n- Update to version 11.2.2:\n  * Features and enhancements:\n    Data sources: Hide the datasource redirection banner for users\n                  who can\u0027t interact with data sources.\n  * Bug fixes:\n    Alerting: Fix preview of silences when label name contains\n              spaces.\n    Alerting: Make query wrapper match up datasource UIDs if\n              necessary.\n    AzureMonitor: Improve resource picker efficiency.\n    AzureMonitor: Remove Basic Logs retention warning.\n    CloudWatch: Fix segfault when migrating legacy queries.\n    DashboardScene: Fix broken error handling and error rendering.\n    Plugins: Avoid returning 404 for AutoEnabled apps.\n\n- Update to version 11.2.1:\n  * Features and enhancements:\n    Alerting: Support for optimistic concurrency in priovisioning\n              Tempate API.\n    Logs panel: Enable displayedFields in dashboards and apps.\n    State timeline: Add pagination support.\n  * Bug fixes:\n    Authn: No longer hash service account token twice during\n           authentication.\n    CloudMigrations: Fix snapshot creation on Windows systems.\n    DashGPT: Fixes issue with generation on Safari.\n    Dashboard: Fix Annotation runtime error when a data source does\n               not support annotations.\n    Grafana SQL: Fix broken import in NumberInput component.\n    Logs: Show older logs button when infinite scroll is enabled\n          and sort order is descending.\n    RBAC: Fix an issue with server admins not being able to manage\n          users in orgs that they don\u0027t belong to.\n    Templating: Fix searching non-latin template variables.\n\n- Upgrade to version 11.2.0:\n  * Features and enhancements:\n    Grafana Cloud Migration Assistant is in public preview.\n    Added navigation bookmarks.\n    Added template variables support in some transformations.\n    Introduced Transpose transformation.\n    Group to nested tables is now generally available.\n    Format string transformation is now generally available.\n    New cumulative and window calculations available in Add field\n      from calculation.\n    Canvas: Standardized tooltips.\n    Canvas: Allow adding data links without using an override.\n    Canvas: Allow opening data links with a single click.\n    Canvas: Add the ability to control the order in which data\n            links are displayed.\n    Added pagination support for state timeline.\n    Centralized alert history page.\n    Grafana Explore now allows for logs filtering and pinning in\n      content outline.\n    Added forward direction search for Loki.\n    Added Cloudwatch Metric Insights cross account observability\n      support.\n    Added Yugabyte data source.\n    Map org-specific user roles from your OAuth provider.\n    Better SAML integration for Azure AD.\n    API support for LDAP configuration (experimental).\n    OpenID Connect Discovery URL for Generic OAuth.\n\n- Update to version 11.1.5:\n  * Bug fixes:\n    Alerting: Fix permissions for prometheus rule endpoints.\n    Alerting: Fix persisting result fingerprint that is used by\n              recovery threshold.\n    RBAC: Fix an issue with server admins not being able to manage\n          users in orgs that they don\u0027t belong to.\n    Snapshots: Fix panic when snapshot_remove_expired is true.\n    VizTooltip: Fix positioning at bottom and right edges on\n                mobile.\n    Plugins: Fix QueryField typeahead missing background color.\n\n- Update to version 11.1.3:\n  * Bug fix:\n    RBAC: Allow plugins to use scoped actions.\n\n- Update to version 11.1.1:\n  * Bug fixes:\n    Alerting: Skip fetching alerts for unsaved dashboards.\n    Alerting: Support utf8_strict_mode: false in Mimir.\n    Scenes: Fixes issue with panel repeat height calculation.\n    Table Panel: Fix Image hover without datalinks.\n    Tempo: Fix grpc streaming support over pdc-agent.\n    RBAC: Allow plugins to use scoped actions.\n\n- Upgrade to version 11.1.0:\n  * Security:\n    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)\n  * Features and improvements:\n    Allow table cell text wrapping.\n    Added stat visualization percent change color mode options.\n    XA chart is generally available.\n    Redesigned settings page for Alerting.\n    Added alerting template selector.\n    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.\n    Improved paused alert visibility.\n    Rule-specific silences with permissions.\n    Support for AWS SNS integration in Grafana-managed alerts.\n    Added GeoMap and panel shortcut keyboard support.\n    Accessability headings improvements.\n    Added reduced motion support.\n\n- Update to version 11.0.1:\n  * Breaking changes:\n    If you had selected your language as \"Portugus Brasileiro\"\n    previously, this will be reset. You have to select it again in\n    your Preferences for the fix to be applied and the translations\n    will then be shown.\n  * Bug fixes:\n    Echo: Suppress errors from frontend-metrics API call failing.\n    Analytics: Fix ApplicationInsights integration.\n    DashboardScene: Fixes issue removing override rule.\n    BrowseDashboards: Prepend subpath to New Browse Dashboard\n                      actions.\n    Alerting: Fix rule storage to filter by group names using\n              case-sensitive comparison.\n    RBAC: List only the folders that the user has access to.\n    DashboardScene: Fixes lack of re-render when updating field\n                    override properties.\n    DashboardScene: Fixes inspect with transforms issue.\n    AzureMonitor: Fix bug detecting app insights queries.\n    Access Control: Clean up permissions for deprovisioned data\n                    sources.\n    Loki: Fix editor history in wrong order.\n    SSE: Fix threshold unmarshal to avoid panic.\n    LibraryPanels/RBAC: Ignore old folder permission check when\n                        deleting/patching lib panel.\n    Dashboards: Correctly display Admin access to dashboards in the\n                UI.\n    LogsTable: Fix default sort by time.\n    Alerting: Fix rules deleting when reordering whilst filtered.\n    Alerting: Fix typo in JSON response for rule export.\n    CloudMonitoring: Fix query type selection issue.\n    Alerting: Fix scheduler to sort rules before evaluation.\n    DashboardScene: Skip panel repeats when values are the same.\n    Alerting: Do not store series values from past evaluations in\n              state manager for no reason.\n    DashboardScene: Fixing major row repeat issues.\n    DashboardScene: Fixes checkbox orienation in save forms.\n\n- Upgrade to version 11.0.0:\n  * Breaking changes:\n    AngularJS support is turned off by default.\n    Legacy alerting is entirely removed.\n    Subfolders cause very rare issues with folders which have\n      slashes in their names.\n    The input data source is removed.\n    Data sources: Responses which are associated with hidden\n      queries will be removed (filtered) by Grafana.\n    The URL which is generated when viewing an individual repeated\n      panel has changed.\n    React Router is deprecated.\n    The grafana/e2e testing tool is deprecated.\n  * Features and enhancements:\n    Introduced Explore Metrics (public preview) and Explore Logs\n      (experimental).\n    Introduced edit mode to provide an easier way to discover and\n      interact with the dashboard edit exprerience.\n    Fixed positioning of template variables and time picker.\n    Introduced dashboard subfolders.\n    Use AI to generate titles and descriptions for panels and\n      dashboards.\n    Canvas: Enhanced flowcharting functionality.\n    Canvas: Universal data link support.\n    Canvas: Added infinite panning editor option.\n    Added colored table rows with conditional formatting.\n    Set threshold colors in the Config from query transformation.\n    Substring matcher added to the Filter by value transformation.\n    Keep Last State for Grafana Managed Alerting.\n    Redesigned alert detail view.\n    The Alerting Provisioning HTTP API has been updated to enforce\n      RBAC.\n    Removed old Tempo Search and Loki Search.\n    MSSQL: Windows Active Directory (Kerberos) authentication.\n    New strong password policy.\n\n- CVE-2025-27144: Fix Go JOSE\u0027s Parsing Vulnerability (bsc#1237671)\n- CVE-2024-51744: Fix bad documentation of error handling in ParseWithClaims (bsc#1232975)\n- CVE-2024-45339: Fix vulnerability when creating log files (bsc#1236559)\n\n- Update to version 10.4.15:\n  * Bugfixes\n    CVE-2024-11741: Fix the Grafana Alerting VictorOps integration\n    (bsc#1236734)\n    Chore: Bump dependency golang.org/x/crypto to v0.31.0\n\n- Update to version 10.4.14:\n  * Bugfixes\n    Alerting: Do not fetch Orgs if the user is authenticated by\n              apikey/sa or render key\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-225",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20654-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231844",
        "url": "https://bugzilla.suse.com/1231844"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1232975",
        "url": "https://bugzilla.suse.com/1232975"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233343",
        "url": "https://bugzilla.suse.com/1233343"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235206",
        "url": "https://bugzilla.suse.com/1235206"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235574",
        "url": "https://bugzilla.suse.com/1235574"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236510",
        "url": "https://bugzilla.suse.com/1236510"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236559",
        "url": "https://bugzilla.suse.com/1236559"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236734",
        "url": "https://bugzilla.suse.com/1236734"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1237671",
        "url": "https://bugzilla.suse.com/1237671"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1238703",
        "url": "https://bugzilla.suse.com/1238703"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241683",
        "url": "https://bugzilla.suse.com/1241683"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241687",
        "url": "https://bugzilla.suse.com/1241687"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241809",
        "url": "https://bugzilla.suse.com/1241809"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243672",
        "url": "https://bugzilla.suse.com/1243672"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243714",
        "url": "https://bugzilla.suse.com/1243714"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1245302",
        "url": "https://bugzilla.suse.com/1245302"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246735",
        "url": "https://bugzilla.suse.com/1246735"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246736",
        "url": "https://bugzilla.suse.com/1246736"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250616",
        "url": "https://bugzilla.suse.com/1250616"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251454",
        "url": "https://bugzilla.suse.com/1251454"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251657",
        "url": "https://bugzilla.suse.com/1251657"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1254113",
        "url": "https://bugzilla.suse.com/1254113"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255340",
        "url": "https://bugzilla.suse.com/1255340"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257337",
        "url": "https://bugzilla.suse.com/1257337"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257349",
        "url": "https://bugzilla.suse.com/1257349"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258136",
        "url": "https://bugzilla.suse.com/1258136"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11741 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11741/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-28180 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-28180/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51744 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51744/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9476 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9476/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11065 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11065/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-21613 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-21613/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-2703 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-2703/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-27144 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-27144/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-29923 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-29923/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3415 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3415/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3454 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3454/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3580 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3580/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4123 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4123/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6023 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6023/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6197 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64751 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64751/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-68156 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-68156/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21720 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21721 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21721/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-21722 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-21722/"
      }
    ],
    "title": "Security update for grafana",
    "tracking": {
      "current_release_date": "2026-04-29T16:12:10Z",
      "generator": {
        "date": "2026-04-29T16:12:10Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20654-1",
      "initial_release_date": "2026-04-29T16:12:10Z",
      "revision_history": [
        {
          "date": "2026-04-29T16:12:10Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.11-bp160.1.1.aarch64",
                "product": {
                  "name": "grafana-11.6.11-bp160.1.1.aarch64",
                  "product_id": "grafana-11.6.11-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.11-bp160.1.1.ppc64le",
                "product": {
                  "name": "grafana-11.6.11-bp160.1.1.ppc64le",
                  "product_id": "grafana-11.6.11-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.11-bp160.1.1.s390x",
                "product": {
                  "name": "grafana-11.6.11-bp160.1.1.s390x",
                  "product_id": "grafana-11.6.11-bp160.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-11.6.11-bp160.1.1.x86_64",
                "product": {
                  "name": "grafana-11.6.11-bp160.1.1.x86_64",
                  "product_id": "grafana-11.6.11-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.11-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64"
        },
        "product_reference": "grafana-11.6.11-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.11-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le"
        },
        "product_reference": "grafana-11.6.11-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.11-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x"
        },
        "product_reference": "grafana-11.6.11-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-11.6.11-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        },
        "product_reference": "grafana-11.6.11-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2024-11741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,   11.2.6, 11.1.11, 11.0.11 and 10.4.15",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11741",
          "url": "https://www.suse.com/security/cve/CVE-2024-11741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236734 for CVE-2024-11741",
          "url": "https://bugzilla.suse.com/1236734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-11741"
    },
    {
      "cve": "CVE-2024-28180",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-28180"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-28180",
          "url": "https://www.suse.com/security/cve/CVE-2024-28180"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234984 for CVE-2024-28180",
          "url": "https://bugzilla.suse.com/1234984"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-28180"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    },
    {
      "cve": "CVE-2024-51744",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51744"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51744",
          "url": "https://www.suse.com/security/cve/CVE-2024-51744"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232936 for CVE-2024-51744",
          "url": "https://bugzilla.suse.com/1232936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51744"
    },
    {
      "cve": "CVE-2024-9264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana\u0027s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9264",
          "url": "https://www.suse.com/security/cve/CVE-2024-9264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231844 for CVE-2024-9264",
          "url": "https://bugzilla.suse.com/1231844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-9264"
    },
    {
      "cve": "CVE-2024-9476",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9476"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9476",
          "url": "https://www.suse.com/security/cve/CVE-2024-9476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233343 for CVE-2024-9476",
          "url": "https://bugzilla.suse.com/1233343"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9476"
    },
    {
      "cve": "CVE-2025-11065",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11065"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11065",
          "url": "https://www.suse.com/security/cve/CVE-2025-11065"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250608 for CVE-2025-11065",
          "url": "https://bugzilla.suse.com/1250608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-11065"
    },
    {
      "cve": "CVE-2025-21613",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-21613"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-21613",
          "url": "https://www.suse.com/security/cve/CVE-2025-21613"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235572 for CVE-2025-21613",
          "url": "https://bugzilla.suse.com/1235572"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-21613"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-2703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-2703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. \n\nA user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-2703",
          "url": "https://www.suse.com/security/cve/CVE-2025-2703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241687 for CVE-2025-2703",
          "url": "https://bugzilla.suse.com/1241687"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-2703"
    },
    {
      "cve": "CVE-2025-27144",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-27144"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-27144",
          "url": "https://www.suse.com/security/cve/CVE-2025-27144"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237608 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237609 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237609"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-27144"
    },
    {
      "cve": "CVE-2025-29923",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-29923"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-29923",
          "url": "https://www.suse.com/security/cve/CVE-2025-29923"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241152 for CVE-2025-29923",
          "url": "https://bugzilla.suse.com/1241152"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-29923"
    },
    {
      "cve": "CVE-2025-3415",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3415"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3415",
          "url": "https://www.suse.com/security/cve/CVE-2025-3415"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245302 for CVE-2025-3415",
          "url": "https://bugzilla.suse.com/1245302"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3415"
    },
    {
      "cve": "CVE-2025-3454",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3454"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This vulnerability in Grafana\u0027s datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3454",
          "url": "https://www.suse.com/security/cve/CVE-2025-3454"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241683 for CVE-2025-3454",
          "url": "https://bugzilla.suse.com/1241683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3454"
    },
    {
      "cve": "CVE-2025-3580",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3580"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\n\nThe vulnerability can be exploited when:\n\n1. An Organization administrator exists\n\n2. The Server administrator is either:\n\n   - Not part of any organization, or\n   - Part of the same organization as the Organization administrator\nImpact:\n\n- Organization administrators can permanently delete Server administrator accounts\n\n- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\n\n- No super-user permissions remain in the system\n\n- Affects all users, organizations, and teams managed in the instance\n\nThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3580",
          "url": "https://www.suse.com/security/cve/CVE-2025-3580"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243672 for CVE-2025-3580",
          "url": "https://bugzilla.suse.com/1243672"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3580"
    },
    {
      "cve": "CVE-2025-4123",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4123"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4123",
          "url": "https://www.suse.com/security/cve/CVE-2025-4123"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243714 for CVE-2025-4123",
          "url": "https://bugzilla.suse.com/1243714"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-4123"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    },
    {
      "cve": "CVE-2025-6023",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6023"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6023",
          "url": "https://www.suse.com/security/cve/CVE-2025-6023"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246735 for CVE-2025-6023",
          "url": "https://bugzilla.suse.com/1246735"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6023"
    },
    {
      "cve": "CVE-2025-6197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.\n\n\nPrerequisites for exploitation:\n\n- Multiple organizations must exist in the Grafana instance\n\n- Victim must be on a different organization than the one specified in the URL",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6197",
          "url": "https://www.suse.com/security/cve/CVE-2025-6197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246736 for CVE-2025-6197",
          "url": "https://bugzilla.suse.com/1246736"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-6197"
    },
    {
      "cve": "CVE-2025-64751",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64751"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 \u003c= Helm chart \u003c= openfga-0.2.48, v.1.4.0 \u003c= docker \u003c= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64751",
          "url": "https://www.suse.com/security/cve/CVE-2025-64751"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254112 for CVE-2025-64751",
          "url": "https://bugzilla.suse.com/1254112"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-64751"
    },
    {
      "cve": "CVE-2025-68156",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-68156"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the\nevaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-68156",
          "url": "https://www.suse.com/security/cve/CVE-2025-68156"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255330 for CVE-2025-68156",
          "url": "https://bugzilla.suse.com/1255330"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-68156"
    },
    {
      "cve": "CVE-2026-21720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21720",
          "url": "https://www.suse.com/security/cve/CVE-2026-21720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257349 for CVE-2026-21720",
          "url": "https://bugzilla.suse.com/1257349"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-21720"
    },
    {
      "cve": "CVE-2026-21721",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21721"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization-internal privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21721",
          "url": "https://www.suse.com/security/cve/CVE-2026-21721"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257337 for CVE-2026-21721",
          "url": "https://bugzilla.suse.com/1257337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-21721"
    },
    {
      "cve": "CVE-2026-21722",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-21722"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
          "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-21722",
          "url": "https://www.suse.com/security/cve/CVE-2026-21722"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258136 for CVE-2026-21722",
          "url": "https://bugzilla.suse.com/1258136"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.s390x",
            "openSUSE Leap 16.0:grafana-11.6.11-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-29T16:12:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-21722"
    }
  ]
}