CVE-2026-25212

An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system...

Grafana 8.1.0 < 11.6.14 / 12.0.0 < 12.1.10 / 12.2.0 < 12.2.8 / 12.3.0 < 12.3.6 / 12.4.0 < 12.4.2 DoS (CVE-2026-28375)

The version of Grafana installed on the remote host is 8.1.x through 11.6.x prior to 11.6.14, 12.0.x through 12.1.x prior to 12.1.10, 12.2.x prior to 12.2.8, 12.3.x prior to 12.3.6, or 12.4.x prior to 12.4.2. It is, therefore, affected by a denial of service vulnerability: - A testdata data-sourc...

PT-2026-29794

An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system...

CVE-2026-25212

Percona PMM prior to 3.7 is affected. An internal database user with superuser privileges can leverage the pmm-admin authenticated Add data source flow to break out of the database context and run shell commands on the underlying OS. This is evidenced in multiple sources (e.g., Percona release no...

BIT-GRAFANA-2026-33375 Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user Viewer to bypass API restrictions and trigger a catastrophic Out-Of-Memory OOM memory exhaustion, crashing the host container...

BIT-GRAFANA-2026-28375 Grafana Testdata datasource can issue unbounded memory allocations

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

SUSE CVE-2026-27877

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve...

SUSE CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

SUSE CVE-2026-33375

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user Viewer to bypass API restrictions and trigger a catastrophic Out-Of-Memory OOM memory exhaustion, crashing the host container...

CVE-2026-28375

A flaw was found in Grafana. A remote attacker with low privileges could exploit this vulnerability by using a specially crafted testdata data-source. This could trigger out-of-memory crashes, leading to a Denial of Service DoS. Mitigation Mitigation for this issue is either not available or the...

EUVD-2026-16638

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

Exposure of Private Personal Information to an Unauthorized Actor

Overview github.com/grafana/grafana/pkg/api is an open and composable observability and data visualization platform. Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the public dashboards. An attacker can obtain sensitive...

CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

UBUNTU-CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

CVE-2026-28375

CVE-2026-28375 affects Grafana via the testdata data-source, where a flaw permits unbounded memory allocations, leading to out-of-memory crashes. The connected CVE entry confirms the root cause as unbounded allocations by the testdata data-source, resulting in availability impact (OOM) . The prov...

CVE-2026-28375 Grafana Testdata datasource can issue unbounded memory allocations

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

Allocation of Resources Without Limits or Throttling

Overview github.com/grafana/grafana/pkg/tsdb is a developer testing tool for Grafana. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the testdata data-source. An attacker can cause the application to crash and become unavailable by...

CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...

CVE-2026-28375

A testdata data-source can be used to trigger out-of-memory crashes in Grafana...