Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / SUSE-SU-2026:2258-1

kritik

SUSE-SU-2026:2258-1

Security update for grafana

En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

Hiçbir kaynak CVSS puanı vermiyor.

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: SUSE.

Açıklama

This update for grafana to version to 11.6.14+security01 fixes the following issues: - Security Fixes: - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950) - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501) - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595) - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873) - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881) - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025) - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026) - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029) - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027) - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263) - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878) - Highlights of other changes and bug fixes: - Version 11.6.13: - Wire the public dashboard service to the HTTP server - Version 11.6.12: - Update authentication redirect logic - Fixed single panel render with variable references

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
SUSE Linux Enterprise 15.7grafana11.6.14+security01-150200.3.88.1

Referanslar

27 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.