Graphite <=1.1.5 - Server-Side Request Forgery

Graphite's sendemail in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is...

EulerOS 2.0 SP11 : graphite2 (EulerOS-SA-2026-4233)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an...

EulerOS 2.0 SP11 : graphite2 (EulerOS-SA-2026-4324)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an...

com.smoketurner.dropwizard:zipkin-core (>=1.3.8-1, <=1.3.9-1), io.dropwizard.metrics:metrics-graphite (4.1.0-rc3) +5 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (4.9.1)

com.rabbitmq:amqp-client MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.8-1, =2.0.0-rc0+test8, =2.11.9, =2.7.12, =2.7.12, =2.11.9, =2.12.0...

com.codacy:metrics-dropwizard_2.11 (>=1.0.33, <=3.1.2), com.codacy:metrics-dropwizard_2.12 (>=1.0.33, <=3.1.2) +428 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.4.1)

com.rabbitmq:amqp-client MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.codacy:metrics-dropwizard2.11 =1.0.33, =1.0.33, =3.1.0, =1.30.0, =1.29.0, =1.29.0, =1.2.0, =v0.0.5, =v0.0.5...

com.smoketurner.dropwizard:zipkin-core (>=1.3.8-1, <=1.3.9-1), io.dropwizard.metrics:metrics-graphite (4.1.0-rc3) +5 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.9.1)

com.rabbitmq:amqp-client MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.8-1, =2.0.0-rc0+test8, =2.11.9, =2.7.12, =2.7.12, =2.11.9, =2.12.0...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibreOffice vulnerabilities (USN-8868-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory. It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause...

USN-8868-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

USN-8868-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

graphite-beacon (>=0.0.1, <=0.22.2) potentially affected by CVE-2026-103261 via tornado (4.0.2)

tornado PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - graphite-beacon =0.0.1, =0.22.2 Source cves: CVE-2026-103261 Source advisory: OSV:GHSA-3HV7-MJH2-FV65...

compactor (>=0.2.0, <=0.3.0), graphite-beacon (>=0.23.0, <=0.26.0) +1 more potentially affected by CVE-2026-103261 via tornado (4.1.0)

tornado PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - compactor =0.2.0, =0.23.0, =0.25.1, =0.25.4.2 Source cves: CVE-2026-103261 Source advisory: OSV:GHSA-3HV7-MJH2-FV65...

graphite-beacon (>=0.0.1, <=0.22.2) potentially affected by CVE-2026-103262 via tornado (4.0.2)

tornado PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - graphite-beacon =0.0.1, =0.22.2 Source cves: CVE-2026-103262 Source advisory: OSV:GHSA-CHX6-46F5-W4VP...

compactor (>=0.2.0, <=0.3.0), graphite-beacon (>=0.23.0, <=0.26.0) +1 more potentially affected by CVE-2026-103262 via tornado (4.1.0)

tornado PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - compactor =0.2.0, =0.23.0, =0.25.1, =0.25.4.2 Source cves: CVE-2026-103262 Source advisory: OSV:GHSA-CHX6-46F5-W4VP...

graphite-beacon (>=0.0.1, <=0.22.2) potentially affected by CVE-2026-103263 via tornado (4.0.2)

tornado PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - graphite-beacon =0.0.1, =0.22.2 Source cves: CVE-2026-103263 Source advisory: OSV:GHSA-C2M8-H5V5-343R...

com.codacy:metrics-dropwizard_2.11 (>=1.0.33, <=3.1.2), com.codacy:metrics-dropwizard_2.12 (>=1.0.33, <=3.1.2) +428 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (4.4.1)

com.rabbitmq:amqp-client MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.codacy:metrics-dropwizard2.11 =1.0.33, =1.0.33, =3.1.0, =1.30.0, =1.29.0, =1.29.0, =1.2.0, =v0.0.5, =v0.0.5...

graphite-beacon (>=0.0.1, <=0.22.2) potentially affected by CVE-2026-82397 via tornado (4.0.2)

tornado PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - graphite-beacon =0.0.1, =0.22.2 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

compactor (>=0.2.0, <=0.3.0), graphite-beacon (>=0.23.0, <=0.26.0) +1 more potentially affected by CVE-2026-82397 via tornado (4.1.0)

tornado PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - compactor =0.2.0, =0.23.0, =0.25.1, =0.25.4.2 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

EulerOS 2.0 SP12 : graphite2 (EulerOS-SA-2026-3265)

According to the versions of the graphite2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an...

compactor (>=0.2.0, <=0.3.0), graphite-beacon (>=0.23.0, <=0.26.0) +1 more potentially affected by CVE-2026-82397 via tornado (4.1.0)

tornado PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - compactor =0.2.0, =0.23.0, =0.25.1, =0.25.4.2 Source cves: CVE-2026-82397 Source advisory: OSV:GHSA-MPF4-983Q-P7J4...

graphite-beacon (>=0.0.1, <=0.22.2) potentially affected by CVE-2026-82397 via tornado (4.0.2)

tornado PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - graphite-beacon =0.0.1, =0.22.2 Source cves: CVE-2026-82397 Source advisory: OSV:GHSA-MPF4-983Q-P7J4...