Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-28376
6.5
MEDIUMCVSS v3
Severity scale
010
Description
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.
grafana/grafana
GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more. = *, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1, >= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8NVD
grafana/grafana
Docker HubThe official Grafana docker container
Docker HubThe official Grafana docker container= *, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1, >= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8NVD
Chocolatey
RubyGems
NPM
Crates.io