Grid Protection Alliance Vulnerability Responses
GPA's Definition of a Vulnerability
GPA's Approach to Coordinated Vulnerability Disclosure
Most Recent
Grid Protection Alliance
November 2026
Vulnerability
SQL Injection via Device Scronym
A critical vulnerability has been identified in both openPDC and openHistorian, which allows an attacker to perform SQL Injection attacks via the Device acronym
Grid Protection Alliance
November 2026
Vulnerability
Missing Security Role Enforcement on Grafana API
A critical vulnerability has been identified in both openPDC and openHistorian, which allows an attacker without the neccesarry role to use the Grafana API to access data stored in the archive
Grid Protection Alliance
November 2026
Previous Vulnerability News
November 2026
SQL Injection via Device Scronym
November 2026
Missing Security Role Enforcement on Grafana API
April 2024
Update to CISA WiX Toolset Vulnerability
February 2024
Response to CISA WiX Toolset Vulnerability
January 2022
Response to Grafana Vulnerability Update
December 2021