rpm package
suse/uyuni-tools&distro=SUSE Multi Linux Manager Tools SLE-Micro-5
pkg:rpm/suse/uyuni-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-Micro-5
Vulnerabilities (26)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-28375 | Med | 6.5 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 27, 2026 | A testdata data-source can be used to trigger out-of-memory crashes in Grafana. | |
| CVE-2026-27879 | Med | 6.5 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 27, 2026 | A resample query can be used to trigger out-of-memory crashes in Grafana. | |
| CVE-2026-27877 | Med | 6.5 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 27, 2026 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as pos | |
| CVE-2026-27876 | Cri | 9.1 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 27, 2026 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only inst | |
| CVE-2026-21724 | Med | 5.4 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 26, 2026 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. | |
| CVE-2026-33186 | Cri | 9.1 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Mar 20, 2026 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi | |
| CVE-2026-21725 | Low | 2.6 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 25, 2026 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior | |
| CVE-2026-27606 | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 25, 2026 | Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a | ||
| CVE-2026-26958 | Low | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 19, 2026 | filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Poin | |
| CVE-2026-21722 | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 12, 2026 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n | ||
| CVE-2026-1615 | Cri | 9.8 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 9, 2026 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. A | |
| CVE-2025-58190 | — | < 5.1.23-150002.3.6.1 | 5.1.23-150002.3.6.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2025-47911 | — | < 5.1.23-150002.3.6.1 | 5.1.23-150002.3.6.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2026-25547 | Cri | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Feb 4, 2026 | @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated nume | |
| CVE-2025-61140 | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Jan 28, 2026 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. | ||
| CVE-2026-21721 | Hig | 8.1 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Jan 27, 2026 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑int | |
| CVE-2026-21720 | — | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Jan 27, 2026 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an un | ||
| CVE-2025-11065 | Med | 5.3 | < 5.1.23-150002.3.6.1 | 5.1.23-150002.3.6.1 | Jan 26, 2026 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data process | |
| CVE-2025-13465 | Med | 5.3 | < 5.1.26-150002.3.12.1 | 5.1.26-150002.3.12.1 | Jan 21, 2026 | Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwritin | |
| CVE-2025-68156 | — | < 5.1.24-150002.3.9.1 | 5.1.24-150002.3.9.1 | Dec 16, 2025 | Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursi |
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
A resample query can be used to trigger out-of-memory crashes in Grafana.
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as pos
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only inst
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior
- CVE-2026-27606Feb 25, 2026affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Poin
- CVE-2026-21722Feb 12, 2026affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. A
- CVE-2025-58190Feb 5, 2026affected < 5.1.23-150002.3.6.1fixed 5.1.23-150002.3.6.1
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-47911Feb 5, 2026affected < 5.1.23-150002.3.6.1fixed 5.1.23-150002.3.6.1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated nume
- CVE-2025-61140Jan 28, 2026affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑int
- CVE-2026-21720Jan 27, 2026affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an un
- affected < 5.1.23-150002.3.6.1fixed 5.1.23-150002.3.6.1
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data process
- affected < 5.1.26-150002.3.12.1fixed 5.1.26-150002.3.12.1
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwritin
- CVE-2025-68156Dec 16, 2025affected < 5.1.24-150002.3.9.1fixed 5.1.24-150002.3.9.1
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursi
Page 1 of 2