Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.Check if you run itEPSS 0.34%May 13, 2026
- Medium6.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem.Check if you run itEPSS 0.37%May 13, 2026
- Medium6.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server.Check if you run itEPSS 0.33%May 13, 2026
- High7.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.Check if you run itEPSS 0.23%May 13, 2026
- High7.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.Check if you run itEPSS 0.28%May 13, 2026
- Medium6.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory.Check if you run itEPSS 0.33%May 13, 2026
- Medium6.5Any Editor could delete any snapshot, even if they have no access to read or write them.Check if you run itEPSS 0.23%May 13, 2026
- Medium6.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error.Check if you run itEPSS 0.26%May 13, 2026
- Medium6.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions.Check if you run itEPSS 0.33%May 13, 2026
- Medium4.3Editors could delete any annotation, even those they do not have read access to.Check if you run itEPSS 0.20%May 13, 2026
- Medium4.9A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN IO…Check if you run itEPSS 0.17%May 13, 2026
- Medium6.1A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7.Patch nowKEVEPSS 0.43%May 13, 2026
- High8.2Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.Check if you run itEPSS 0.38%May 13, 2026
- High7.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.56%May 13, 2026
- High8.2Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.Check if you run itEPSS 0.51%May 13, 2026
- High7.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.99%May 13, 2026
- High7.1Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.22%May 13, 2026
- High7.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.27%May 13, 2026
- Critical9.1Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.84%May 13, 2026
- High7.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.46%May 13, 2026
- High7.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.44%May 13, 2026
- Critical9.8Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.63%May 13, 2026
- Medium6.5Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 0.38%May 13, 2026
- Critical9.1Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 1.01%May 13, 2026
- Low2.9Netty is an asynchronous, event-driven network application framework.Check if you run itEPSS 1.06%May 13, 2026
Sort