AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

GO-2026-5167 File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser...

CVE-2026-40075

OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the /openmrs/moduleResources/moduleid endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from...

CVE-2026-28383

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

PT-2026-41871

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A broken access control issue exists in the Account Resources user lookup endpoint. A remote authenticated user who owns at least one User-Managed Access UMA resource can enumerate and harve...

Path Traversal

org.openmrs.web, openmrs-web is vulnerable to Path Traversal. The vulnerability is due to improper path boundary validation in the /openmrs/moduleResources/moduleid endpoint, where user-controlled input is concatenated into filesystem paths without normalization or restriction checks, which allow...

BIT-GRAFANA-2026-28383 Grafana plugin resources can lead to unbounded memory allocation

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service...

UBUNTU-CVE-2026-28383

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service...

Allocation of Resources Without Limits or Throttling

Overview github.com/grafana/grafana/pkg/api is an open and composable observability and data visualization platform. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the plugin resources endpoint when the system reads the entire request...

CVE-2026-28383

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service...

PT-2026-40786

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A request to the plugin resources endpoint can cause unbounded memory allocation because the entire request body is read into memory. An authenticated user can exploit this to trigger an...

CVE-2026-28383: Allocation of Resources Without Limits or Throttling

A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user can exploit this to trigger an out-of-memory condition, potentially causing a denial of service...

CVE-2026-40075

OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the /openmrs/moduleResources/moduleid endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from...

Missing Authorization

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Missing Authorization in the resourceGetHandler process. An attacker can access the full content of text files within their authorized scope by sending requests to the...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the resourceGetHandler process. An attacker can access the full content of text files within their authorized scope by sending requests to the /api/resources endpoint, bypassing the intended download permission...

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

Summary The resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints /api/raw, /api/preview, /api/subtitle correctly verify this permission before serving content. A user with download: fals...

CVE-2026-35606 File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other...