uyuni-tools (SUSE:Multi Linux Manager Tools SLE-Micro-5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Multi Linux Manager Tools SLE-Micro-5 package uyuni-tools, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (26)

• CVE-2026-1615 — CVSS 9.8 (critical): Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path…
• CVE-2025-61140 — CVSS 9.8 (critical): The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
• CVE-2026-27606 — CVSS 9.8 (critical): Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and…
• CVE-2026-25547: @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is…
• CVE-2026-33186 — CVSS 9.1 (critical): gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input…
• CVE-2026-27876 — CVSS 9.1 (critical): A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is…
• CVE-2025-64751 — CVSS 8.8 (high): OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA…
• CVE-2025-12816 — CVSS 8.6 (high): An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft…
• CVE-2026-21721 — CVSS 8.1 (high): The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result…
• CVE-2025-6023 — CVSS 7.6 (high): An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was…
• CVE-2026-21720 — CVSS 7.5 (high): Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue…
• CVE-2025-47908 — CVSS 7.5 (high): Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a…
• CVE-2025-68156 — CVSS 7.5 (high): Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including…
• CVE-2026-27879 — CVSS 6.5 (medium): A resample query can be used to trigger out-of-memory crashes in Grafana.
• CVE-2026-28375 — CVSS 6.5 (medium): A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
• CVE-2026-27877 — CVSS 6.5 (medium): When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards…
• CVE-2026-21724 — CVSS 5.4 (medium): A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with…
• CVE-2025-11065 — CVSS 5.3 (medium): A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This…
• CVE-2026-21722 — CVSS 5.3 (medium): Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This…
• CVE-2025-58190 — CVSS 5.3 (medium): The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of…
• CVE-2025-47911 — CVSS 5.3 (medium): The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial…
• CVE-2025-13465 — CVSS 5.3 (medium): Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass…
• CVE-2025-3415 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected…
• CVE-2025-6197 — CVSS 4.2 (medium): An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -…
• CVE-2026-21725 — CVSS 2.6 (low): A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission…
• CVE-2026-26958: filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In…