{"schema_version":"2","view":"grouped","data":[{"id":70940,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/advisories/advisory%3A45f9121d-759d-4996-8ca9-7f3de8553eb6","group":{"id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","revision":1,"primary_event_id":71311,"change":"published","superseded_by":[],"changed":{"id":71311,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/events/71311"},"members":[{"id":71311,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/events/71311"}]}},{"id":62306,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-572c-8r39-8pp7","summary":"CGA-572c-8r39-8pp7","evidence":"osv:CGA-572c-8r39-8pp7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-572c-8r39-8pp7","aliases":["CGA-572c-8r39-8pp7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-572c-8r39-8pp7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T11:43:00Z"}]}}],"modified":"2026-10-01T16:31:44.474543792Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:606d6832-19bd-41c7-a821-ce08bbebe6ba","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-572c-8r39-8pp7","advisory_id":"606d6832-19bd-41c7-a821-ce08bbebe6ba","event_types":["advisory"],"published_at":"2026-10-25T19:04:03.374247+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:37:18+00:00","detail_url":"/advisories/advisory%3A606d6832-19bd-41c7-a821-ce08bbebe6ba","group":{"id":"advisory:606d6832-19bd-41c7-a821-ce08bbebe6ba","revision":1,"primary_event_id":61546,"change":"published","superseded_by":[],"changed":{"id":61546,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-572c-8r39-8pp7","summary":"CGA-572c-8r39-8pp7","evidence":"osv:CGA-572c-8r39-8pp7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-572c-8r39-8pp7","aliases":["CGA-572c-8r39-8pp7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-572c-8r39-8pp7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T11:43:00Z"}]}}],"modified":"2026-10-01T16:31:44.474543792Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:606d6832-19bd-41c7-a821-ce08bbebe6ba","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-572c-8r39-8pp7","advisory_id":"606d6832-19bd-41c7-a821-ce08bbebe6ba","event_types":["advisory"],"published_at":"2026-10-25T19:04:03.374247+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:37:18+00:00","detail_url":"/events/61546"},"members":[{"id":61546,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-572c-8r39-8pp7","summary":"CGA-572c-8r39-8pp7","evidence":"osv:CGA-572c-8r39-8pp7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-572c-8r39-8pp7","aliases":["CGA-572c-8r39-8pp7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-572c-8r39-8pp7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T11:43:00Z"}]}}],"modified":"2026-10-01T16:31:44.474543792Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:606d6832-19bd-41c7-a821-ce08bbebe6ba","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-572c-8r39-8pp7","advisory_id":"606d6832-19bd-41c7-a821-ce08bbebe6ba","event_types":["advisory"],"published_at":"2026-10-25T19:04:03.374247+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:37:18+00:00","detail_url":"/events/61546"}]}},{"id":44951,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rvr2-vrrm-4g32","summary":"CGA-rvr2-vrrm-4g32","evidence":"osv:CGA-rvr2-vrrm-4g32","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rvr2-vrrm-4g32","aliases":["CGA-rvr2-vrrm-4g32"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rvr2-vrrm-4g32.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:14Z"}]}}],"modified":"2026-09-30T17:02:08.950185852Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9105efea-c5be-4e9b-8286-6f16b7834297","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rvr2-vrrm-4g32","advisory_id":"9105efea-c5be-4e9b-8286-6f16b7834297","event_types":["advisory"],"published_at":"2026-10-25T12:18:11.910356+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:21+00:00","detail_url":"/advisories/advisory%3A9105efea-c5be-4e9b-8286-6f16b7834297","group":{"id":"advisory:9105efea-c5be-4e9b-8286-6f16b7834297","revision":1,"primary_event_id":44521,"change":"published","superseded_by":[],"changed":{"id":44521,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rvr2-vrrm-4g32","summary":"CGA-rvr2-vrrm-4g32","evidence":"osv:CGA-rvr2-vrrm-4g32","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rvr2-vrrm-4g32","aliases":["CGA-rvr2-vrrm-4g32"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rvr2-vrrm-4g32.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:14Z"}]}}],"modified":"2026-09-30T17:02:08.950185852Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9105efea-c5be-4e9b-8286-6f16b7834297","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rvr2-vrrm-4g32","advisory_id":"9105efea-c5be-4e9b-8286-6f16b7834297","event_types":["advisory"],"published_at":"2026-10-25T12:18:11.910356+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:21+00:00","detail_url":"/events/44521"},"members":[{"id":44521,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rvr2-vrrm-4g32","summary":"CGA-rvr2-vrrm-4g32","evidence":"osv:CGA-rvr2-vrrm-4g32","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rvr2-vrrm-4g32","aliases":["CGA-rvr2-vrrm-4g32"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rvr2-vrrm-4g32.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:14Z"}]}}],"modified":"2026-09-30T17:02:08.950185852Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9105efea-c5be-4e9b-8286-6f16b7834297","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rvr2-vrrm-4g32","advisory_id":"9105efea-c5be-4e9b-8286-6f16b7834297","event_types":["advisory"],"published_at":"2026-10-25T12:18:11.910356+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:21+00:00","detail_url":"/events/44521"}]}},{"id":43552,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5qjw-gmgh-g8xw","summary":"CGA-5qjw-gmgh-g8xw","evidence":"osv:CGA-5qjw-gmgh-g8xw","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qjw-gmgh-g8xw","aliases":["CGA-5qjw-gmgh-g8xw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qjw-gmgh-g8xw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:13Z"}]}}],"modified":"2026-09-30T17:01:51.931889588Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d978d579-64f0-4346-9f02-74f16a19c06d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qjw-gmgh-g8xw","advisory_id":"d978d579-64f0-4346-9f02-74f16a19c06d","event_types":["advisory"],"published_at":"2026-10-25T11:55:03.079565+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/advisories/advisory%3Ad978d579-64f0-4346-9f02-74f16a19c06d","group":{"id":"advisory:d978d579-64f0-4346-9f02-74f16a19c06d","revision":1,"primary_event_id":43148,"change":"published","superseded_by":[],"changed":{"id":43148,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5qjw-gmgh-g8xw","summary":"CGA-5qjw-gmgh-g8xw","evidence":"osv:CGA-5qjw-gmgh-g8xw","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qjw-gmgh-g8xw","aliases":["CGA-5qjw-gmgh-g8xw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qjw-gmgh-g8xw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:13Z"}]}}],"modified":"2026-09-30T17:01:51.931889588Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d978d579-64f0-4346-9f02-74f16a19c06d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qjw-gmgh-g8xw","advisory_id":"d978d579-64f0-4346-9f02-74f16a19c06d","event_types":["advisory"],"published_at":"2026-10-25T11:55:03.079565+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/events/43148"},"members":[{"id":43148,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5qjw-gmgh-g8xw","summary":"CGA-5qjw-gmgh-g8xw","evidence":"osv:CGA-5qjw-gmgh-g8xw","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5qjw-gmgh-g8xw","aliases":["CGA-5qjw-gmgh-g8xw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5qjw-gmgh-g8xw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:13Z"}]}}],"modified":"2026-09-30T17:01:51.931889588Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d978d579-64f0-4346-9f02-74f16a19c06d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5qjw-gmgh-g8xw","advisory_id":"d978d579-64f0-4346-9f02-74f16a19c06d","event_types":["advisory"],"published_at":"2026-10-25T11:55:03.079565+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/events/43148"}]}},{"id":43445,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8m64-3cpq-qc68","summary":"CGA-8m64-3cpq-qc68","evidence":"osv:CGA-8m64-3cpq-qc68","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8m64-3cpq-qc68","aliases":["CGA-8m64-3cpq-qc68"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8m64-3cpq-qc68.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:16Z"}]}}],"modified":"2026-09-30T17:01:49.099651318Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4e7bd89-6a15-43df-8538-4cb3a057175b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8m64-3cpq-qc68","advisory_id":"a4e7bd89-6a15-43df-8538-4cb3a057175b","event_types":["advisory"],"published_at":"2026-10-25T11:53:53.44685+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/advisories/advisory%3Aa4e7bd89-6a15-43df-8538-4cb3a057175b","group":{"id":"advisory:a4e7bd89-6a15-43df-8538-4cb3a057175b","revision":1,"primary_event_id":43042,"change":"published","superseded_by":[],"changed":{"id":43042,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8m64-3cpq-qc68","summary":"CGA-8m64-3cpq-qc68","evidence":"osv:CGA-8m64-3cpq-qc68","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8m64-3cpq-qc68","aliases":["CGA-8m64-3cpq-qc68"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8m64-3cpq-qc68.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:16Z"}]}}],"modified":"2026-09-30T17:01:49.099651318Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4e7bd89-6a15-43df-8538-4cb3a057175b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8m64-3cpq-qc68","advisory_id":"a4e7bd89-6a15-43df-8538-4cb3a057175b","event_types":["advisory"],"published_at":"2026-10-25T11:53:53.44685+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/events/43042"},"members":[{"id":43042,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8m64-3cpq-qc68","summary":"CGA-8m64-3cpq-qc68","evidence":"osv:CGA-8m64-3cpq-qc68","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8m64-3cpq-qc68","aliases":["CGA-8m64-3cpq-qc68"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8m64-3cpq-qc68.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:16Z"}]}}],"modified":"2026-09-30T17:01:49.099651318Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a4e7bd89-6a15-43df-8538-4cb3a057175b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8m64-3cpq-qc68","advisory_id":"a4e7bd89-6a15-43df-8538-4cb3a057175b","event_types":["advisory"],"published_at":"2026-10-25T11:53:53.44685+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:07+00:00","detail_url":"/events/43042"}]}},{"id":43119,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j4p3-f276-jhrh","summary":"CGA-j4p3-f276-jhrh","evidence":"osv:CGA-j4p3-f276-jhrh","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j4p3-f276-jhrh","aliases":["CGA-j4p3-f276-jhrh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4p3-f276-jhrh.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:15Z"}]}}],"modified":"2026-09-30T17:01:40.740011078Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7042164b-b19c-4be8-89a4-22298d140c0c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4p3-f276-jhrh","advisory_id":"7042164b-b19c-4be8-89a4-22298d140c0c","event_types":["advisory"],"published_at":"2026-10-25T11:48:39.217267+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T18:05:11+00:00","detail_url":"/advisories/advisory%3A7042164b-b19c-4be8-89a4-22298d140c0c","group":{"id":"advisory:7042164b-b19c-4be8-89a4-22298d140c0c","revision":1,"primary_event_id":42720,"change":"published","superseded_by":[],"changed":{"id":42720,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j4p3-f276-jhrh","summary":"CGA-j4p3-f276-jhrh","evidence":"osv:CGA-j4p3-f276-jhrh","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j4p3-f276-jhrh","aliases":["CGA-j4p3-f276-jhrh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4p3-f276-jhrh.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:15Z"}]}}],"modified":"2026-09-30T17:01:40.740011078Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7042164b-b19c-4be8-89a4-22298d140c0c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4p3-f276-jhrh","advisory_id":"7042164b-b19c-4be8-89a4-22298d140c0c","event_types":["advisory"],"published_at":"2026-10-25T11:48:39.217267+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T18:05:11+00:00","detail_url":"/events/42720"},"members":[{"id":42720,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j4p3-f276-jhrh","summary":"CGA-j4p3-f276-jhrh","evidence":"osv:CGA-j4p3-f276-jhrh","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j4p3-f276-jhrh","aliases":["CGA-j4p3-f276-jhrh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j4p3-f276-jhrh.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:15Z"}]}}],"modified":"2026-09-30T17:01:40.740011078Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7042164b-b19c-4be8-89a4-22298d140c0c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j4p3-f276-jhrh","advisory_id":"7042164b-b19c-4be8-89a4-22298d140c0c","event_types":["advisory"],"published_at":"2026-10-25T11:48:39.217267+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T18:05:11+00:00","detail_url":"/events/42720"}]}},{"id":41025,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7fj8-c72p-gpwg","summary":"CGA-7fj8-c72p-gpwg","evidence":"osv:CGA-7fj8-c72p-gpwg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7fj8-c72p-gpwg","aliases":["CGA-7fj8-c72p-gpwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fj8-c72p-gpwg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:13Z"}]}}],"modified":"2026-09-30T17:01:25.001605123Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fj8-c72p-gpwg","advisory_id":"461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","event_types":["advisory"],"published_at":"2026-10-25T11:06:50.490529+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:21:41+00:00","detail_url":"/advisories/advisory%3A461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","group":{"id":"advisory:461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","revision":1,"primary_event_id":40645,"change":"published","superseded_by":[],"changed":{"id":40645,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7fj8-c72p-gpwg","summary":"CGA-7fj8-c72p-gpwg","evidence":"osv:CGA-7fj8-c72p-gpwg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7fj8-c72p-gpwg","aliases":["CGA-7fj8-c72p-gpwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fj8-c72p-gpwg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:13Z"}]}}],"modified":"2026-09-30T17:01:25.001605123Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fj8-c72p-gpwg","advisory_id":"461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","event_types":["advisory"],"published_at":"2026-10-25T11:06:50.490529+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:21:41+00:00","detail_url":"/events/40645"},"members":[{"id":40645,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7fj8-c72p-gpwg","summary":"CGA-7fj8-c72p-gpwg","evidence":"osv:CGA-7fj8-c72p-gpwg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7fj8-c72p-gpwg","aliases":["CGA-7fj8-c72p-gpwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7fj8-c72p-gpwg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:13Z"}]}}],"modified":"2026-09-30T17:01:25.001605123Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7fj8-c72p-gpwg","advisory_id":"461ecad8-cc8e-4b88-b452-bc9d9c12b4cf","event_types":["advisory"],"published_at":"2026-10-25T11:06:50.490529+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:21:41+00:00","detail_url":"/events/40645"}]}},{"id":41010,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7455-953q-4gh5","summary":"CGA-7455-953q-4gh5","evidence":"osv:CGA-7455-953q-4gh5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7455-953q-4gh5","aliases":["CGA-7455-953q-4gh5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7455-953q-4gh5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:17Z"}]}}],"modified":"2026-09-30T17:01:24.780841377Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0295335-7d90-487a-9fc1-6c5a68d554c3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7455-953q-4gh5","advisory_id":"e0295335-7d90-487a-9fc1-6c5a68d554c3","event_types":["advisory"],"published_at":"2026-10-25T11:06:41.103469+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/advisories/advisory%3Ae0295335-7d90-487a-9fc1-6c5a68d554c3","group":{"id":"advisory:e0295335-7d90-487a-9fc1-6c5a68d554c3","revision":1,"primary_event_id":40630,"change":"published","superseded_by":[],"changed":{"id":40630,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7455-953q-4gh5","summary":"CGA-7455-953q-4gh5","evidence":"osv:CGA-7455-953q-4gh5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7455-953q-4gh5","aliases":["CGA-7455-953q-4gh5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7455-953q-4gh5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:17Z"}]}}],"modified":"2026-09-30T17:01:24.780841377Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0295335-7d90-487a-9fc1-6c5a68d554c3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7455-953q-4gh5","advisory_id":"e0295335-7d90-487a-9fc1-6c5a68d554c3","event_types":["advisory"],"published_at":"2026-10-25T11:06:41.103469+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/events/40630"},"members":[{"id":40630,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7455-953q-4gh5","summary":"CGA-7455-953q-4gh5","evidence":"osv:CGA-7455-953q-4gh5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7455-953q-4gh5","aliases":["CGA-7455-953q-4gh5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7455-953q-4gh5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:17Z"}]}}],"modified":"2026-09-30T17:01:24.780841377Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e0295335-7d90-487a-9fc1-6c5a68d554c3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7455-953q-4gh5","advisory_id":"e0295335-7d90-487a-9fc1-6c5a68d554c3","event_types":["advisory"],"published_at":"2026-10-25T11:06:41.103469+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/events/40630"}]}},{"id":40971,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5rvp-c7xj-98wg","summary":"CGA-5rvp-c7xj-98wg","evidence":"osv:CGA-5rvp-c7xj-98wg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5rvp-c7xj-98wg","aliases":["CGA-5rvp-c7xj-98wg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5rvp-c7xj-98wg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:10Z"}]}}],"modified":"2026-09-30T17:01:23.765518594Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e27107e-bc98-4aeb-b360-bea57249855c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5rvp-c7xj-98wg","advisory_id":"0e27107e-bc98-4aeb-b360-bea57249855c","event_types":["advisory"],"published_at":"2026-10-25T11:05:44.02114+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:45:07+00:00","detail_url":"/advisories/advisory%3A0e27107e-bc98-4aeb-b360-bea57249855c","group":{"id":"advisory:0e27107e-bc98-4aeb-b360-bea57249855c","revision":1,"primary_event_id":40592,"change":"published","superseded_by":[],"changed":{"id":40592,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5rvp-c7xj-98wg","summary":"CGA-5rvp-c7xj-98wg","evidence":"osv:CGA-5rvp-c7xj-98wg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5rvp-c7xj-98wg","aliases":["CGA-5rvp-c7xj-98wg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5rvp-c7xj-98wg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:10Z"}]}}],"modified":"2026-09-30T17:01:23.765518594Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e27107e-bc98-4aeb-b360-bea57249855c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5rvp-c7xj-98wg","advisory_id":"0e27107e-bc98-4aeb-b360-bea57249855c","event_types":["advisory"],"published_at":"2026-10-25T11:05:44.02114+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:45:07+00:00","detail_url":"/events/40592"},"members":[{"id":40592,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5rvp-c7xj-98wg","summary":"CGA-5rvp-c7xj-98wg","evidence":"osv:CGA-5rvp-c7xj-98wg","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5rvp-c7xj-98wg","aliases":["CGA-5rvp-c7xj-98wg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5rvp-c7xj-98wg.json"},"ecosystem_specific":{"components":[{"component_name":"golang.org/x/text","component_purl":"pkg:golang/golang.org/x/text@v0.37.0","component_type":"go-module","component_version":"v0.37.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:10Z"}]}}],"modified":"2026-09-30T17:01:23.765518594Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e27107e-bc98-4aeb-b360-bea57249855c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5rvp-c7xj-98wg","advisory_id":"0e27107e-bc98-4aeb-b360-bea57249855c","event_types":["advisory"],"published_at":"2026-10-25T11:05:44.02114+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-22T17:45:07+00:00","detail_url":"/events/40592"}]}},{"id":40963,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5vfg-m3px-rf5g","summary":"CGA-5vfg-m3px-rf5g","evidence":"osv:CGA-5vfg-m3px-rf5g","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5vfg-m3px-rf5g","aliases":["CGA-5vfg-m3px-rf5g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5vfg-m3px-rf5g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:11Z"}]}}],"modified":"2026-09-30T17:01:23.751815609Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c690fe21-3d51-41c6-92b5-58e1f3e9295e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5vfg-m3px-rf5g","advisory_id":"c690fe21-3d51-41c6-92b5-58e1f3e9295e","event_types":["advisory"],"published_at":"2026-10-25T11:05:37.724389+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/advisories/advisory%3Ac690fe21-3d51-41c6-92b5-58e1f3e9295e","group":{"id":"advisory:c690fe21-3d51-41c6-92b5-58e1f3e9295e","revision":1,"primary_event_id":40584,"change":"published","superseded_by":[],"changed":{"id":40584,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5vfg-m3px-rf5g","summary":"CGA-5vfg-m3px-rf5g","evidence":"osv:CGA-5vfg-m3px-rf5g","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5vfg-m3px-rf5g","aliases":["CGA-5vfg-m3px-rf5g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5vfg-m3px-rf5g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:11Z"}]}}],"modified":"2026-09-30T17:01:23.751815609Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c690fe21-3d51-41c6-92b5-58e1f3e9295e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5vfg-m3px-rf5g","advisory_id":"c690fe21-3d51-41c6-92b5-58e1f3e9295e","event_types":["advisory"],"published_at":"2026-10-25T11:05:37.724389+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/events/40584"},"members":[{"id":40584,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5vfg-m3px-rf5g","summary":"CGA-5vfg-m3px-rf5g","evidence":"osv:CGA-5vfg-m3px-rf5g","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5vfg-m3px-rf5g","aliases":["CGA-5vfg-m3px-rf5g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5vfg-m3px-rf5g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:07:11Z"}]}}],"modified":"2026-09-30T17:01:23.751815609Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c690fe21-3d51-41c6-92b5-58e1f3e9295e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5vfg-m3px-rf5g","advisory_id":"c690fe21-3d51-41c6-92b5-58e1f3e9295e","event_types":["advisory"],"published_at":"2026-10-25T11:05:37.724389+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T12:22:06+00:00","detail_url":"/events/40584"}]}},{"id":40697,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3cvx-rmwc-36rm","summary":"CGA-3cvx-rmwc-36rm","evidence":"osv:CGA-3cvx-rmwc-36rm","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3cvx-rmwc-36rm","aliases":["CGA-3cvx-rmwc-36rm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3cvx-rmwc-36rm.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:17Z"}]}}],"modified":"2026-09-30T17:00:40.855956447Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3cvx-rmwc-36rm","advisory_id":"1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","event_types":["advisory"],"published_at":"2026-10-25T11:01:39.475951+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:19+00:00","detail_url":"/advisories/advisory%3A1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","group":{"id":"advisory:1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","revision":1,"primary_event_id":40322,"change":"published","superseded_by":[],"changed":{"id":40322,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3cvx-rmwc-36rm","summary":"CGA-3cvx-rmwc-36rm","evidence":"osv:CGA-3cvx-rmwc-36rm","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3cvx-rmwc-36rm","aliases":["CGA-3cvx-rmwc-36rm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3cvx-rmwc-36rm.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:17Z"}]}}],"modified":"2026-09-30T17:00:40.855956447Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3cvx-rmwc-36rm","advisory_id":"1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","event_types":["advisory"],"published_at":"2026-10-25T11:01:39.475951+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:19+00:00","detail_url":"/events/40322"},"members":[{"id":40322,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-3cvx-rmwc-36rm","summary":"CGA-3cvx-rmwc-36rm","evidence":"osv:CGA-3cvx-rmwc-36rm","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-3cvx-rmwc-36rm","aliases":["CGA-3cvx-rmwc-36rm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3cvx-rmwc-36rm.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:17Z"}]}}],"modified":"2026-09-30T17:00:40.855956447Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3cvx-rmwc-36rm","advisory_id":"1b48f65d-50e9-4220-b2c8-31e7bb7a71d8","event_types":["advisory"],"published_at":"2026-10-25T11:01:39.475951+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:19+00:00","detail_url":"/events/40322"}]}},{"id":40654,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2r3m-qhcg-49fj","summary":"CGA-2r3m-qhcg-49fj","evidence":"osv:CGA-2r3m-qhcg-49fj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2r3m-qhcg-49fj","aliases":["CGA-2r3m-qhcg-49fj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2r3m-qhcg-49fj.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:15Z"}]}}],"modified":"2026-09-30T17:00:33.043993709Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d70af9fb-cd7d-4014-8f9f-04396fd00e75","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2r3m-qhcg-49fj","advisory_id":"d70af9fb-cd7d-4014-8f9f-04396fd00e75","event_types":["advisory"],"published_at":"2026-10-25T11:00:07.165297+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/advisories/advisory%3Ad70af9fb-cd7d-4014-8f9f-04396fd00e75","group":{"id":"advisory:d70af9fb-cd7d-4014-8f9f-04396fd00e75","revision":1,"primary_event_id":40280,"change":"published","superseded_by":[],"changed":{"id":40280,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2r3m-qhcg-49fj","summary":"CGA-2r3m-qhcg-49fj","evidence":"osv:CGA-2r3m-qhcg-49fj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2r3m-qhcg-49fj","aliases":["CGA-2r3m-qhcg-49fj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2r3m-qhcg-49fj.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:15Z"}]}}],"modified":"2026-09-30T17:00:33.043993709Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d70af9fb-cd7d-4014-8f9f-04396fd00e75","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2r3m-qhcg-49fj","advisory_id":"d70af9fb-cd7d-4014-8f9f-04396fd00e75","event_types":["advisory"],"published_at":"2026-10-25T11:00:07.165297+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/events/40280"},"members":[{"id":40280,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2r3m-qhcg-49fj","summary":"CGA-2r3m-qhcg-49fj","evidence":"osv:CGA-2r3m-qhcg-49fj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2r3m-qhcg-49fj","aliases":["CGA-2r3m-qhcg-49fj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2r3m-qhcg-49fj.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0","component_type":"go-module","component_version":"v1.43.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:15Z"}]}}],"modified":"2026-09-30T17:00:33.043993709Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d70af9fb-cd7d-4014-8f9f-04396fd00e75","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2r3m-qhcg-49fj","advisory_id":"d70af9fb-cd7d-4014-8f9f-04396fd00e75","event_types":["advisory"],"published_at":"2026-10-25T11:00:07.165297+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/events/40280"}]}},{"id":40636,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mcf-w4jm-88rr","summary":"CGA-2mcf-w4jm-88rr","evidence":"osv:CGA-2mcf-w4jm-88rr","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mcf-w4jm-88rr","aliases":["CGA-2mcf-w4jm-88rr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mcf-w4jm-88rr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:16Z"}]}}],"modified":"2026-09-30T17:00:26.990671393Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ffef73ff-f940-4c79-8d34-3c2b1162ab44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mcf-w4jm-88rr","advisory_id":"ffef73ff-f940-4c79-8d34-3c2b1162ab44","event_types":["advisory"],"published_at":"2026-10-25T10:59:55.337708+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/advisories/advisory%3Affef73ff-f940-4c79-8d34-3c2b1162ab44","group":{"id":"advisory:ffef73ff-f940-4c79-8d34-3c2b1162ab44","revision":1,"primary_event_id":40262,"change":"published","superseded_by":[],"changed":{"id":40262,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mcf-w4jm-88rr","summary":"CGA-2mcf-w4jm-88rr","evidence":"osv:CGA-2mcf-w4jm-88rr","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mcf-w4jm-88rr","aliases":["CGA-2mcf-w4jm-88rr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mcf-w4jm-88rr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:16Z"}]}}],"modified":"2026-09-30T17:00:26.990671393Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ffef73ff-f940-4c79-8d34-3c2b1162ab44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mcf-w4jm-88rr","advisory_id":"ffef73ff-f940-4c79-8d34-3c2b1162ab44","event_types":["advisory"],"published_at":"2026-10-25T10:59:55.337708+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/events/40262"},"members":[{"id":40262,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mcf-w4jm-88rr","summary":"CGA-2mcf-w4jm-88rr","evidence":"osv:CGA-2mcf-w4jm-88rr","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mcf-w4jm-88rr","aliases":["CGA-2mcf-w4jm-88rr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mcf-w4jm-88rr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","component_purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:16Z"}]}}],"modified":"2026-09-30T17:00:26.990671393Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ffef73ff-f940-4c79-8d34-3c2b1162ab44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mcf-w4jm-88rr","advisory_id":"ffef73ff-f940-4c79-8d34-3c2b1162ab44","event_types":["advisory"],"published_at":"2026-10-25T10:59:55.337708+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T13:58:20+00:00","detail_url":"/events/40262"}]}},{"id":40601,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pr57-gg8v-w659","summary":"CGA-pr57-gg8v-w659","evidence":"osv:CGA-pr57-gg8v-w659","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pr57-gg8v-w659","aliases":["CGA-pr57-gg8v-w659"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr57-gg8v-w659.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:10Z"}]}}],"modified":"2026-09-30T17:00:22.028549133Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62194543-a5f1-424a-9de6-43fbfc93fc83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr57-gg8v-w659","advisory_id":"62194543-a5f1-424a-9de6-43fbfc93fc83","event_types":["advisory"],"published_at":"2026-10-25T10:59:31.646814+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:38:10+00:00","detail_url":"/advisories/advisory%3A62194543-a5f1-424a-9de6-43fbfc93fc83","group":{"id":"advisory:62194543-a5f1-424a-9de6-43fbfc93fc83","revision":1,"primary_event_id":40227,"change":"published","superseded_by":[],"changed":{"id":40227,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pr57-gg8v-w659","summary":"CGA-pr57-gg8v-w659","evidence":"osv:CGA-pr57-gg8v-w659","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pr57-gg8v-w659","aliases":["CGA-pr57-gg8v-w659"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr57-gg8v-w659.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:10Z"}]}}],"modified":"2026-09-30T17:00:22.028549133Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62194543-a5f1-424a-9de6-43fbfc93fc83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr57-gg8v-w659","advisory_id":"62194543-a5f1-424a-9de6-43fbfc93fc83","event_types":["advisory"],"published_at":"2026-10-25T10:59:31.646814+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:38:10+00:00","detail_url":"/events/40227"},"members":[{"id":40227,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pr57-gg8v-w659","summary":"CGA-pr57-gg8v-w659","evidence":"osv:CGA-pr57-gg8v-w659","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"11.6.16-r15","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pr57-gg8v-w659","aliases":["CGA-pr57-gg8v-w659"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.16-r15"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr57-gg8v-w659.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel","component_purl":"pkg:golang/go.opentelemetry.io/otel@v1.44.0","component_type":"go-module","component_version":"v1.44.0","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T10:37:10Z"}]}}],"modified":"2026-09-30T17:00:22.028549133Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81870.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62194543-a5f1-424a-9de6-43fbfc93fc83","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr57-gg8v-w659","advisory_id":"62194543-a5f1-424a-9de6-43fbfc93fc83","event_types":["advisory"],"published_at":"2026-10-25T10:59:31.646814+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:38:10+00:00","detail_url":"/events/40227"}]}},{"id":39711,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-m2rx-hm9w-q2cx","summary":"MINI-m2rx-hm9w-q2cx","evidence":"osv:MINI-m2rx-hm9w-q2cx","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-m2rx-hm9w-q2cx","aliases":["MINI-m2rx-hm9w-q2cx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-m2rx-hm9w-q2cx.json"}}],"modified":"2026-09-30T15:46:22.499283017Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0a537c2e-5ad1-4b10-b198-766f5580b956","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-m2rx-hm9w-q2cx","advisory_id":"0a537c2e-5ad1-4b10-b198-766f5580b956","event_types":["advisory"],"published_at":"2026-10-25T10:45:04.11163+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T15:15:38+00:00","detail_url":"/advisories/advisory%3A0a537c2e-5ad1-4b10-b198-766f5580b956","group":{"id":"advisory:0a537c2e-5ad1-4b10-b198-766f5580b956","revision":1,"primary_event_id":39350,"change":"published","superseded_by":[],"changed":{"id":39350,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-m2rx-hm9w-q2cx","summary":"MINI-m2rx-hm9w-q2cx","evidence":"osv:MINI-m2rx-hm9w-q2cx","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-m2rx-hm9w-q2cx","aliases":["MINI-m2rx-hm9w-q2cx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-m2rx-hm9w-q2cx.json"}}],"modified":"2026-09-30T15:46:22.499283017Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0a537c2e-5ad1-4b10-b198-766f5580b956","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-m2rx-hm9w-q2cx","advisory_id":"0a537c2e-5ad1-4b10-b198-766f5580b956","event_types":["advisory"],"published_at":"2026-10-25T10:45:04.11163+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T15:15:38+00:00","detail_url":"/events/39350"},"members":[{"id":39350,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-m2rx-hm9w-q2cx","summary":"MINI-m2rx-hm9w-q2cx","evidence":"osv:MINI-m2rx-hm9w-q2cx","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-m2rx-hm9w-q2cx","aliases":["MINI-m2rx-hm9w-q2cx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-m2rx-hm9w-q2cx.json"}}],"modified":"2026-09-30T15:46:22.499283017Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0a537c2e-5ad1-4b10-b198-766f5580b956","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-m2rx-hm9w-q2cx","advisory_id":"0a537c2e-5ad1-4b10-b198-766f5580b956","event_types":["advisory"],"published_at":"2026-10-25T10:45:04.11163+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T15:15:38+00:00","detail_url":"/events/39350"}]}},{"id":19295,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w279-42hv-xmfj","summary":"CGA-w279-42hv-xmfj","evidence":"osv:CGA-w279-42hv-xmfj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w279-42hv-xmfj","aliases":["CGA-w279-42hv-xmfj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w279-42hv-xmfj.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T12:37:24Z"}]}}],"modified":"2026-09-26T16:15:27.246593900Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w279-42hv-xmfj","advisory_id":"e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","event_types":["advisory"],"published_at":"2026-10-25T02:04:52.307699+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T11:56:21+00:00","detail_url":"/advisories/advisory%3Ae4aab39b-e0b2-4c00-87e3-2a1c4ac91984","group":{"id":"advisory:e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","revision":1,"primary_event_id":19160,"change":"published","superseded_by":[],"changed":{"id":19160,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w279-42hv-xmfj","summary":"CGA-w279-42hv-xmfj","evidence":"osv:CGA-w279-42hv-xmfj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w279-42hv-xmfj","aliases":["CGA-w279-42hv-xmfj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w279-42hv-xmfj.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T12:37:24Z"}]}}],"modified":"2026-09-26T16:15:27.246593900Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w279-42hv-xmfj","advisory_id":"e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","event_types":["advisory"],"published_at":"2026-10-25T02:04:52.307699+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T11:56:21+00:00","detail_url":"/events/19160"},"members":[{"id":19160,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w279-42hv-xmfj","summary":"CGA-w279-42hv-xmfj","evidence":"osv:CGA-w279-42hv-xmfj","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w279-42hv-xmfj","aliases":["CGA-w279-42hv-xmfj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w279-42hv-xmfj.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T12:37:24Z"}]}}],"modified":"2026-09-26T16:15:27.246593900Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w279-42hv-xmfj","advisory_id":"e4aab39b-e0b2-4c00-87e3-2a1c4ac91984","event_types":["advisory"],"published_at":"2026-10-25T02:04:52.307699+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T11:56:21+00:00","detail_url":"/events/19160"}]}},{"id":19248,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-64vq-hm2w-7gv7","summary":"CGA-64vq-hm2w-7gv7","evidence":"osv:CGA-64vq-hm2w-7gv7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-64vq-hm2w-7gv7","aliases":["CGA-64vq-hm2w-7gv7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-64vq-hm2w-7gv7.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T14:24:43Z"}]}}],"modified":"2026-09-26T16:15:12.982758821Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b535298-5ca7-4a4f-b86f-339a1b79797a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-64vq-hm2w-7gv7","advisory_id":"7b535298-5ca7-4a4f-b86f-339a1b79797a","event_types":["advisory"],"published_at":"2026-10-25T02:04:20.663075+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:56:09+00:00","detail_url":"/advisories/advisory%3A7b535298-5ca7-4a4f-b86f-339a1b79797a","group":{"id":"advisory:7b535298-5ca7-4a4f-b86f-339a1b79797a","revision":1,"primary_event_id":19113,"change":"published","superseded_by":[],"changed":{"id":19113,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-64vq-hm2w-7gv7","summary":"CGA-64vq-hm2w-7gv7","evidence":"osv:CGA-64vq-hm2w-7gv7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-64vq-hm2w-7gv7","aliases":["CGA-64vq-hm2w-7gv7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-64vq-hm2w-7gv7.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T14:24:43Z"}]}}],"modified":"2026-09-26T16:15:12.982758821Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b535298-5ca7-4a4f-b86f-339a1b79797a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-64vq-hm2w-7gv7","advisory_id":"7b535298-5ca7-4a4f-b86f-339a1b79797a","event_types":["advisory"],"published_at":"2026-10-25T02:04:20.663075+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:56:09+00:00","detail_url":"/events/19113"},"members":[{"id":19113,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-64vq-hm2w-7gv7","summary":"CGA-64vq-hm2w-7gv7","evidence":"osv:CGA-64vq-hm2w-7gv7","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-64vq-hm2w-7gv7","aliases":["CGA-64vq-hm2w-7gv7"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-64vq-hm2w-7gv7.json"},"ecosystem_specific":{"components":[{"component_name":"grafana-11.6","component_purl":"pkg:apk/grafana-11.6@11.6.16-r13","component_type":"apk","component_version":"11.6.16-r13","component_location":"/.PKGINFO","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-09-26T14:24:43Z"}]}}],"modified":"2026-09-26T16:15:12.982758821Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7b535298-5ca7-4a4f-b86f-339a1b79797a","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-64vq-hm2w-7gv7","advisory_id":"7b535298-5ca7-4a4f-b86f-339a1b79797a","event_types":["advisory"],"published_at":"2026-10-25T02:04:20.663075+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T12:56:09+00:00","detail_url":"/events/19113"}]}},{"id":15466,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-v8pc-7rfv-g6x5","summary":"MINI-v8pc-7rfv-g6x5","evidence":"osv:MINI-v8pc-7rfv-g6x5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"grafana-11.6-oci-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-v8pc-7rfv-g6x5","aliases":["MINI-v8pc-7rfv-g6x5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6-oci-compat","purl":"pkg:apk/minimos/grafana-11.6-oci-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}}],"modified":"2026-09-25T16:00:04.272601634Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a3f23781-8675-49a1-9b64-647cbc964b3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-v8pc-7rfv-g6x5","advisory_id":"a3f23781-8675-49a1-9b64-647cbc964b3e","event_types":["advisory"],"published_at":"2026-10-25T00:59:01.268915+00:00","technologies":["core-osv","grafana-11-6","grafana-11-6-oci-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:20:14+00:00","detail_url":"/advisories/advisory%3Aa3f23781-8675-49a1-9b64-647cbc964b3e","group":{"id":"advisory:a3f23781-8675-49a1-9b64-647cbc964b3e","revision":1,"primary_event_id":15382,"change":"published","superseded_by":[],"changed":{"id":15382,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-v8pc-7rfv-g6x5","summary":"MINI-v8pc-7rfv-g6x5","evidence":"osv:MINI-v8pc-7rfv-g6x5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"grafana-11.6-oci-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-v8pc-7rfv-g6x5","aliases":["MINI-v8pc-7rfv-g6x5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6-oci-compat","purl":"pkg:apk/minimos/grafana-11.6-oci-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}}],"modified":"2026-09-25T16:00:04.272601634Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a3f23781-8675-49a1-9b64-647cbc964b3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-v8pc-7rfv-g6x5","advisory_id":"a3f23781-8675-49a1-9b64-647cbc964b3e","event_types":["advisory"],"published_at":"2026-10-25T00:59:01.268915+00:00","technologies":["core-osv","grafana-11-6","grafana-11-6-oci-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:20:14+00:00","detail_url":"/events/15382"},"members":[{"id":15382,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-v8pc-7rfv-g6x5","summary":"MINI-v8pc-7rfv-g6x5","evidence":"osv:MINI-v8pc-7rfv-g6x5","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"grafana-11.6-oci-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-v8pc-7rfv-g6x5","aliases":["MINI-v8pc-7rfv-g6x5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/minimos/grafana-11.6","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6-oci-compat","purl":"pkg:apk/minimos/grafana-11.6-oci-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-v8pc-7rfv-g6x5.json"}}],"modified":"2026-09-25T16:00:04.272601634Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a3f23781-8675-49a1-9b64-647cbc964b3e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-v8pc-7rfv-g6x5","advisory_id":"a3f23781-8675-49a1-9b64-647cbc964b3e","event_types":["advisory"],"published_at":"2026-10-25T00:59:01.268915+00:00","technologies":["core-osv","grafana-11-6","grafana-11-6-oci-compat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:20:14+00:00","detail_url":"/events/15382"}]}}],"next_after":70940,"next_before":15466}