Approved changes feed: RSS · Atom
cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Graphite Project (06fd3190-4e2c-5b36-8348-b55d20affd6e) |
|---|---|
| Product | Graphite (aa9e122a-9cb2-52f6-84a5-321e3645d4dd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/graphite-web |
purl2cpe | 2026-06-01 10:13:12.247380 |
pkg:deb/ubuntu/graphite-web |
purl2cpe | 2026-06-01 10:13:12.247383 |
pkg:github/graphite-project/graphite-web |
purl2cpe | 2026-06-01 10:13:12.247386 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50593 |
vulnerable | 2026-06-08 08:07:02.847163 |
Details available
HIGH (7.3)
Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.
Published: 2026-06-05T02:14:33.412Z
Updated: 2026-06-05T18:22:18.882Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18638 |
vulnerable | 2026-06-08 05:09:11.327091 |
Details available
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Published: 2019-10-11T22:01:28.000Z
Updated: 2024-08-05T21:28:55.975Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-5943 |
vulnerable | 2026-06-08 05:04:54.742932 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published: 2013-09-27T10:00:00.000Z
Updated: 2024-09-16T20:42:38.912Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.