184 matches found
grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates
A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...
grafana: Grafana: Denial of Service via uncontrolled memory usage in alertmanager templates
A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...
CLEANSTART-2026-GW32041 Security fixes in prometheus-alertmanager 0.34.0-r1
Package prometheus-alertmanager version 0.34.0-r1 fixes 2 vulnerabilities: CVE-2026-56864, CVE-2026-56865...
BIT-GRAFANA-2026-17033 CVE-2026-17033 CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
SUSE SLES15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:3714-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3714-1 advisory. prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and...
CVE-2026-17033
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
CVE-2026-17033 CVE-2026-17033 CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
CVE-2026-17033 CVE-2026-17033 CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
EUVD-2026-64887
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
CVE-2026-17033
Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...
PT-2026-80879
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders...
Grafana OSS: Stored XSS via external Alertmanager generatorURL
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user’s Grafana session. Grafana renders...
GO-2023-2020 vulnerabilities
Vulnerabilities for packages: prometheus-alertmanager, promxy...
GO-2024-2883 vulnerabilities
Vulnerabilities for packages: cortex, prometheus-alertmanager, timestamp-authority, timestamp-authority-fips, cortex-fips, argo-cd, rekor, fulcio, rekor-fips, fulcio-fips, prometheus-alertmanager-fips, grafana-mimir...
GO-2023-2020 vulnerabilities
Vulnerabilities for packages: promxy, prometheus-alertmanager...
GO-2024-2883 vulnerabilities
Vulnerabilities for packages: fulcio, timestamp-authority, prometheus-alertmanager, rekor, grafana-mimir, cortex...
CVE-2026-67990
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...
CLEANSTART-2026-IU92725 Security fixes in prometheus-alertmanager 0.32.0-r0
Package prometheus-alertmanager version 0.32.0-r0 fixes 2 vulnerabilities: CVE-2026-39882, CVE-2026-39883...
CLEANSTART-2026-ZP59365 Security fixes in prometheus-alertmanager 0.32.0-r1
Package prometheus-alertmanager version 0.32.0-r1 fixes 19 vulnerabilities: CVE-2026-39835, CVE-2026-46598, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502...