Open Source Vulnerabilities

apache-hive

In the Jakarta Expression Language implementation 3

grafana

avatar feature in Grafana 3

grafana

Grafana Enterprise 7

grafana

One of the usage insights HTTP API endpoints in Grafana Enterprise 6

grafana

team sync HTTP API in Grafana Enterprise 6

grafana

team sync HTTP API in Grafana Enterprise 7

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana is an open-source platform for monitoring and observability

grafana

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)

grafana

Security fix for CVE-2024-6837 applied in: grafana 11.1.4-r0

grafana

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path

grafana

security vulnerability in the /apis/dashboard

grafana

built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability

grafana

Security fix for GHSA-jq9f-gm9w-rwm9 applied in: grafana 12.3.2-r0

highcharts

TuxCare security update for highcharts (5 CVEs)

kedacore-http-add-on, kedacore-http-add-on

KEDA is a Kubernetes-based Event Driven Autoscaling component

grafana

padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2

grafana

OpenFGA is an authorization/permission engine built for developers

grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

grafana

Security fix for GHSA-68m9-983m-f3v5 applied in: grafana 13.0.0-r0

grafana

Security fix for GHSA-h6c8-cww8-35hf applied in: grafana 13.0.0-r0

grafana

Security fix for GHSA-jwvj-g8pc-cx45 applied in: grafana 13.0.0-r0

grafana

Security fix for GHSA-pjcq-xvwp-hhpj applied in: grafana 13.0.1-r0

grafana

Security fix for GHSA-57j5-qwp2-vqp6 applied in: grafana 13.0.1-r0

grafana

Security fix for GHSA-497x-rrr9-68jp applied in: grafana 13.0.1-r0

grafana

CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...

grafana

OpenFGA is an authorization/permission engine built for developers

grafana, grafana, grafana

vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

grafana, grafana

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

grafana, grafana

Security fix for GHSA-p4r4-xvrq-gvmc applied in: grafana 13.0.2-r1, grafana 13.1.0-r1

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

grafana, grafana, grafana

Security fix for GHSA-ffqx-q65f-36jf applied in: grafana 13.0.2-r1, grafana 13.1.0-r1, grafana 13.1.0-r2

kedacore-http-add-on, kedacore-http-add-on

KEDA is a Kubernetes-based Event Driven Autoscaling component

azure-functions-extension-bundles, azure-functions-extension-bundles

MessagePack for C# is a MessagePack serializer for C#

gomplate, kustomize, opa-fips, git-lfs, kedacore-http-add-on

On most platforms, Go uses the given system root certificates

langfuse

undici's cache interceptor mishandles malformed Cache-Control private directives

gitea, gitea

Security fix for GHSA-44p7-9xx4-hf2g applied in: gitea 1.25.5-r0

dompurify

TuxCare security update for dompurify (1 CVE)

zod, @rootio/zod

CVE-2023-54404 in zod - Patched by Root

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)