Provenance Record

Compact Briefing (559 words, within 300-800). Clear Overview / What We Know / What We Don't Know / Analysis structure; the article gives no fixed-version ranges and tells operators to consult each advisory.

All eight sources are first-party (github.com/grafana/grafana release tags and grafana.com security advisories); no third-party outlet is used. Read snapshots source-0..3.html.gz (release tags) and source-4..7.html.gz (advisories), all HTTP 200, no archive fallback, no suspicious_patterns. Cross-checked the release notes against the raw GitHub releases API text (live): v13.2.4 published 2026-10-13T11:41Z, v13.1.8 13:01Z, v13.0.11 11:56Z, v12.4.13 13:09Z; Security sections list CVE-2026-15577/33374/93294/95502 in 13.2.4, 13.1.8, 13.0.11, and only the first three in 12.4.13. Advisories: CVE-2026-15577 'Git Sync connection configuration can be modified with read-only access', Medium, CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), published 2026-10-13, Fixed Versions >=12.4.13/>=13.0.11/>=13.1.8/>=13.2.4, 12.4 only with experimental provisioning toggle. CVE-2026-33374 'Unbounded memory allocation in the Prometheus rule conversion API', Medium 6.5 (A:H), same fixed set. CVE-2026-93294 'Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs', Medium 6.3 (S:C, C:H), same fixed set, impact bounded by Azure role. CVE-2026-95502 'Git Sync memory exhaustion via a malicious Git server', Medium 5.3 (PR:N, A:L), fixed set starts at 13.0.11 (no 12.x), requires admin to have configured Git Sync with that server. All CVE-to-component mappings, titles (verbatim), severity labels and CVSS scores in the article match; the 5.3-6.5 range is correct. The advisory pages state no CWE ID (CWE names appear only in prose, e.g. 'incorrect authorization'), no credits and no exploitation status; the article claims none of these. Release-note quotes 'Strip sensitive headers from oauth2 cross-host redirects' and 'Fall back when collection deletion is unsupported' are verbatim and present in v13.2.4 and v13.0.11 (also 13.1.8 and 12.4.13). CVE-2026-92539 appears only as a Bug fixes entry ('IAM: Fix: SCIM (Enterprise)' in 13.2.4/13.1.8; 'Scim endpoints (Enterprise)' in 13.0.11/12.4.13); its advisory URL returns 404, so the article's 'not covered' treatment is accurate. Allowlist: github.com (line 1131) and grafana.com (line 1260) are both present by exact hostname.

Every specific (date October 13, four release lines, CVE IDs, titles, severity, CVSS, mechanisms, preconditions) traces to the cited sources. The 'Four' CVEs framing is correct: the Security sections list exactly four, and the fifth identifier (CVE-2026-92539) is a separate Enterprise SCIM bug-fix entry that the article discloses. Minor imprecision: the headline lists four releases as fixing 'Four' CVEs, but 12.4.13 fixes three (the body states this correctly). The advisory version-range inconsistency the article mentions is real (e.g. '<12.4.0', '<12.0.0', '<8.1.0' lower bounds, and 95502 has no 12.x entry).

Accurate, well-sourced first-party Briefing. Approved with one headline clarification.