Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2026-33378 — MEDIUM severity vulnerability | Release Alert

CVE-2026-33378

6.5

MEDIUMCVSS v3

Published

May 13, 2026

Affected

7 projects

Assigned by

[email protected]

Severity scale

010

Description

Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server.

grafana/grafana

GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

grafana/grafana

Docker HubThe official Grafana docker container

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

More on this CVE

NVD↗GitHub Advisory↗

ChocolateyGrafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

Python Package Indexgrafana

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

RubyGemsA simple wrapper for the Grafana HTTP API

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

NPMThis is a placeholder Grafana.com project for @types/grafana

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD

Crates.ioErgonomic Rust SDK for Grafana's HTTP API, with async and blocking clients.

>= 8.0.0, < 11.6.14, >= 12.0.0, < 12.2.8, >= 12.3.0, < 12.3.6, >= 12.4.0, < 12.4.3, = 11.6.14, = 12.2.8, = 12.3.6, = 12.4.3, = 13.0.0, = 13.0.1NVD