[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-19475":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":86,"aliases":87,"duplicate_of":9,"upstream":150,"downstream":151,"duplicates":154,"related":155,"reserved_at":9,"published_at":157,"modified_at":158,"state":159,"summary":160,"references_raw":169,"kevs":176,"epss":177,"epss_history":180,"metrics":230,"affected":238},"CVE-2026-19475","An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","weakness","Draft","Class","High",[20,24,82],{"id":21,"name":22,"techniques":23},"CAPEC-147","XML Ping of the Death",[],{"id":25,"name":26,"techniques":27},"CAPEC-227","Sustained Client Engagement",[28],{"id":29,"name":30,"tactics":31,"countermeasures":35},"T1499","Endpoint Denial of Service",[32],{"id":33,"name":34},"TA0105","Impact",[36,41,45,49,53,57,61,66,70,74,78],{"id":37,"name":38,"tactic":39},"D3-ISVA","Inbound Session Volume Analysis",{"name":40},"Detect",{"id":42,"name":43,"tactic":44},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":40},{"id":46,"name":47,"tactic":48},"D3-APCA","Application Protocol Command Analysis",{"name":40},{"id":50,"name":51,"tactic":52},"D3-NTCD","Network Traffic Community Deviation",{"name":40},{"id":54,"name":55,"tactic":56},"D3-RTSD","Remote Terminal Session Detection",{"name":40},{"id":58,"name":59,"tactic":60},"D3-CSPP","Client-server Payload Profiling",{"name":40},{"id":62,"name":63,"tactic":64},"D3-NTF","Network Traffic Filtering",{"name":65},"Isolate",{"id":67,"name":68,"tactic":69},"D3-ITF","Inbound Traffic Filtering",{"name":65},{"id":71,"name":72,"tactic":73},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":40},{"id":75,"name":76,"tactic":77},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":40},{"id":79,"name":80,"tactic":81},"D3-NTSA","Network Traffic Signature Analysis",{"name":40},{"id":83,"name":84,"techniques":85},"CAPEC-492","Regular Expression Exponential Blowup",[],[],[88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"CGA-6q59-hvqg-6c7q","CGA-fwvx-f2rg-fmh7","CGA-gp5p-3h93-j3wp","CGA-jw4f-7h8g-hpfr","CGA-v4gf-59w4-5xh2","CGA-4f37-33cr-45pj","CGA-5qpc-pj3m-m32p","CGA-hmf5-392w-c8m8","CGA-w9f9-fjh8-xvcw","CGA-22jf-454x-jcc8","CGA-2jch-9c8p-4w9h","CGA-3qp3-g6vx-xvm7","CGA-3r7q-2w48-8fqj","CGA-3wqm-qqv5-jgc7","CGA-4rm4-f8w6-2pj9","CGA-6p6h-q33g-3wc9","CGA-7mcp-8jp6-9f95","CGA-99qm-4q24-fm3r","CGA-9xrw-ghm9-vj52","CGA-c8rq-x25c-r2cv","CGA-cgq5-cv5g-j5p3","CGA-fphq-fhh4-h4xh","CGA-gmc6-vvr9-xp3p","CGA-hg84-9pvq-q77f","CGA-hwr9-7264-pm85","CGA-jwr5-4fh8-7qvf","CGA-mmcr-x4j8-xvfp","CGA-mp53-53wg-2jj4","CGA-mr6p-4gqp-p7wg","CGA-rxpw-xg6f-mfhc","CGA-rxvp-j83x-w4rw","CGA-vq4f-rjx6-5jc7","CGA-vqhm-53cp-v965","CGA-xc6c-fpj5-ppf3","CGA-xggr-2gv2-hw9c","CGA-x625-x5c8-5jfm","CGA-2h4h-9jjx-4453","CGA-5q49-4hmj-hjqx","CGA-r9vw-6wxx-x2j6","CGA-4588-7rjm-g99x","CGA-8pv5-9h6r-923w","CGA-95jv-566x-mwrj","CGA-r752-rhw2-56p9","CGA-v334-hj2g-fjqg","CGA-456p-mvvr-r5c8","CGA-62m4-j847-jq9r","CGA-63fp-mggv-pwm4","CGA-95jc-9rgr-mw3w","CGA-974m-g68r-74pr","CGA-h37g-7vrc-rxv9","CGA-h3r3-rr4v-877h","CGA-h7wh-qh69-wr2v","CGA-j3g4-338g-rch2","CGA-m22w-fh5c-6hp9","CGA-m449-7vw7-47hf","CGA-m873-53j5-vg9v","CGA-q2r6-mwmp-ggqq","CGA-q726-63r6-r59f","CGA-q7j4-rpxv-p6c2","CGA-w26j-g2jq-4cf6","CGA-x63c-wc5v-xc8h","CGA-x7wf-8hxc-p5fj",[],[152],{"_key":153},"OPENSUSE-SU-2026:11684-1",[],[156],{"_key":153},"2026-09-02T15:56:33.568Z","2026-09-03T08:08:02.649Z","Awaiting Analysis",{"cisa_kev":161,"cisa_ransomware":161,"cisa_vendor":9,"epss_severity":162,"epss_score":163,"severity":164,"severity_score":165,"severity_version":166,"severity_source":167,"severity_vector":168,"severity_status":159},false,"low",0.00401,"medium",6.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",[170],{"url":171,"sources":172,"tags":174},"https://grafana.com/security/security-advisories/cve-2026-19475",[167,173],"nvd",[175],"Vendor Advisory",[],{"date":178,"score":163,"percentile":179},"2026-09-19",0.34179,[181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229],{"date":182,"score":163,"percentile":183},"2026-09-03",0.33326,{"date":185,"score":163,"percentile":186},"2026-09-04",0.33362,{"date":188,"score":163,"percentile":189},"2026-09-05",0.33343,{"date":191,"score":163,"percentile":192},"2026-09-06",0.33432,{"date":194,"score":163,"percentile":195},"2026-09-07",0.33433,{"date":197,"score":163,"percentile":198},"2026-09-08",0.33447,{"date":200,"score":163,"percentile":201},"2026-09-09",0.33603,{"date":203,"score":163,"percentile":204},"2026-09-10",0.3362,{"date":206,"score":163,"percentile":207},"2026-09-11",0.33642,{"date":209,"score":163,"percentile":210},"2026-09-12",0.33735,{"date":212,"score":163,"percentile":213},"2026-09-13",0.33688,{"date":215,"score":163,"percentile":216},"2026-09-14",0.33708,{"date":218,"score":163,"percentile":219},"2026-09-15",0.33779,{"date":221,"score":163,"percentile":222},"2026-09-16",0.3394,{"date":224,"score":163,"percentile":225},"2026-09-17",0.34014,{"date":227,"score":163,"percentile":228},"2026-09-18",0.34161,{"date":178,"score":163,"percentile":179},[231,236],{"source":167,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":232,"cvss_v4_0":9},{"baseScore":165,"baseSeverity":233,"vectorString":168,"impactScore":234,"exploitabilityScore":235},"MEDIUM",6,7.2,{"source":173,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":237,"cvss_v4_0":9},{"baseScore":165,"baseSeverity":233,"vectorString":168,"impactScore":234,"exploitabilityScore":235},[239,249,253,257,261,269,273,277,281,285,289,294,333,340,347],{"ecosystem":240,"name":241,"vendor":242,"product":241,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":241,"source":9,"versions":244},"Chainguard","grafana-11.6","chainguard","apk",[245],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":240,"name":250,"vendor":242,"product":250,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":250,"source":9,"versions":251},"grafana-12.1",[252],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":254,"vendor":242,"product":254,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":254,"source":9,"versions":255},"grafana-12.2",[256],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":258,"vendor":242,"product":258,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":258,"source":9,"versions":259},"grafana-12.3",[260],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":262,"vendor":242,"product":262,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":262,"source":9,"versions":263},"grafana-13.1",[264,265],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":266,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":267,"version_end_type":268,"fixed_in":9},"lt13_1_5_r0","13.1.5-r0","excluding",{"ecosystem":240,"name":270,"vendor":242,"product":270,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":270,"source":9,"versions":271},"grafana-fips-11.6",[272],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":274,"vendor":242,"product":274,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":274,"source":9,"versions":275},"grafana-fips-12.1",[276],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":278,"vendor":242,"product":278,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":278,"source":9,"versions":279},"grafana-fips-12.2",[280],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":282,"vendor":242,"product":282,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":282,"source":9,"versions":283},"grafana-fips-12.3",[284],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":240,"name":286,"vendor":242,"product":286,"cpe_part":9,"purl_type":243,"purl_namespace":242,"purl_name":286,"source":9,"versions":287},"percona-grafana",[288],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":290,"name":258,"vendor":291,"product":258,"cpe_part":9,"purl_type":243,"purl_namespace":291,"purl_name":258,"source":9,"versions":292},"Wolfi","wolfi",[293],{"version":246,"is_range":247,"range_type":248,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":295,"vendor":296,"product":297,"cpe_part":298,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":299},"Grafana OSS","grafana","grafana oss","a",[300,305,309,313,317,321,325,329],{"version":301,"is_range":247,"range_type":167,"version_start":302,"version_start_type":303,"version_end":304,"version_end_type":303,"fixed_in":9},">= 11.6.0, \u003C= 11.6.16","11.6.0","including","11.6.16",{"version":306,"is_range":247,"range_type":167,"version_start":307,"version_start_type":303,"version_end":308,"version_end_type":303,"fixed_in":9},">= 12.0.0, \u003C= 12.0.10","12.0.0","12.0.10",{"version":310,"is_range":247,"range_type":167,"version_start":311,"version_start_type":303,"version_end":312,"version_end_type":303,"fixed_in":9},">= 12.1.0, \u003C= 12.1.10","12.1.0","12.1.10",{"version":314,"is_range":247,"range_type":167,"version_start":315,"version_start_type":303,"version_end":316,"version_end_type":303,"fixed_in":9},">= 12.2.0, \u003C= 12.2.10","12.2.0","12.2.10",{"version":318,"is_range":247,"range_type":167,"version_start":319,"version_start_type":303,"version_end":320,"version_end_type":303,"fixed_in":9},">= 12.3.0, \u003C= 12.3.11","12.3.0","12.3.11",{"version":322,"is_range":247,"range_type":167,"version_start":323,"version_start_type":303,"version_end":324,"version_end_type":303,"fixed_in":9},">= 12.4.0, \u003C= 12.4.9","12.4.0","12.4.9",{"version":326,"is_range":247,"range_type":167,"version_start":327,"version_start_type":303,"version_end":328,"version_end_type":303,"fixed_in":9},">= 13.0.0, \u003C= 13.0.7","13.0.0","13.0.7",{"version":330,"is_range":247,"range_type":167,"version_start":331,"version_start_type":303,"version_end":332,"version_end_type":303,"fixed_in":9},">= 13.1.0, \u003C= 13.1.4","13.1.0","13.1.4",{"ecosystem":9,"name":334,"vendor":296,"product":335,"cpe_part":298,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":336},"Microsoft SQL Server Datasource","microsoft sql server datasource",[337],{"version":338,"is_range":247,"range_type":167,"version_start":327,"version_start_type":303,"version_end":339,"version_end_type":303,"fixed_in":9},">= 13.0.0, \u003C= 13.0.1","13.0.1",{"ecosystem":9,"name":341,"vendor":296,"product":342,"cpe_part":298,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":343},"MySQL Datasource","mysql datasource",[344],{"version":345,"is_range":247,"range_type":167,"version_start":327,"version_start_type":303,"version_end":346,"version_end_type":303,"fixed_in":9},">= 13.0.0, \u003C= 13.0.2","13.0.2",{"ecosystem":9,"name":348,"vendor":296,"product":349,"cpe_part":298,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":350},"PostgreSQL Datasource","postgresql datasource",[351],{"version":338,"is_range":247,"range_type":167,"version_start":327,"version_start_type":303,"version_end":339,"version_end_type":303,"fixed_in":9}]