CVE-2026-33382

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-333844.8QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatio CVE-2026-333855.1A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user in CVE-2026-333862.3QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can per CVE-2026-333874.6A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authe CVE-2026-333887.4An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A CVE-2026-333897.5An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted con CVE-2026-33392.7The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_CVE-2026-333908.1An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permiss CVE-2026-333915.4An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privi CVE-2026-333927.2In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass CVE-2026-333934.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains CVE-2026-333942.7Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/