grafana vulnerabilities (Alpine)

54 vulnerabilities.

• grafana Alpine Server-side expression parser denial of service CVE-2026-88858 Fix available 6.5 MediumOctober 28, 2026
• grafana Alpine Azure Monitor access token disclosure via SSRF CVE-2026-88967 Fix available 7.7 HighOctober 28, 2026
• grafana Alpine Alerting contact point authorization bypass via schema downgrade CVE-2026-100105 Public exploitFix available 7.7 HighOctober 28, 2026
• grafana Alpine Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs CVE-2026-93294 Fix available 6.3 MediumOctober 13, 2026
• grafana Alpine Unbounded memory allocation in the Prometheus rule conversion API CVE-2026-33374 Fix available 6.5 MediumOctober 13, 2026
• grafana Alpine Git Sync connection configuration can be modified with read-only access CVE-2026-15577 Fix available 6.5 MediumOctober 13, 2026
• grafana Alpine Editor can forge file-provisioning provenance on dashboards via the dashboard API CVE-2026-13720 Fix available 5.4 MediumSeptember 30, 2026
• grafana Alpine Alert rules in restricted folders disclosed via the alert rules list API CVE-2026-13719 Fix available 4.3 MediumSeptember 30, 2026
• grafana Alpine Library panel can be moved into a folder without library panel create permission CVE-2026-81842 Fix available 4.3 MediumSeptember 29, 2026
• grafana Alpine Paused shared dashboard access tokens still expose data source configuration CVE-2026-81841 Fix available 5.3 MediumSeptember 29, 2026
• grafana Alpine OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors CVE-2026-79656 Fix available 6.0 MediumSeptember 29, 2026
• grafana Alpine CVE-2026-15815 CVE Record CVE-2026-15815 Fix available 8.8 HighSeptember 17, 2026
• grafana Alpine CVE-2026-76154 CVE Record CVE-2026-76154 Fix available 7.3 HighSeptember 17, 2026
• grafana Alpine Session takeover via Auth Proxy cache key collision CVE-2026-14199 Fix available 7.1 HighSeptember 2, 2026
• grafana Alpine SAML assertion replay via skipped InResponseTo validation CVE-2026-12704 Fix available 6.8 MediumSeptember 2, 2026
• grafana Alpine SQL Data Source Plugin: OOM DoS via $__timeGroup macro CVE-2026-19475 Fix available 6.5 MediumSeptember 2, 2026
• grafana Alpine CVE-2026-17183 CVE Record CVE-2026-17183 Fix available 7.1 HighAugust 19, 2026
• grafana Alpine Stored XSS in the table panel (TableNG) CVE-2026-8595 Fix available 6.8 MediumJuly 10, 2026
• grafana Alpine Pre-authentication denial of service via the OAuth login route CVE-2026-8609 Fix available 5.3 MediumJuly 10, 2026
• grafana Alpine Denial of service via unbounded request body size CVE-2026-33382 Fix available 7.5 HighJuly 10, 2026
• grafana Alpine Stored XSS in the Geomap panel tile-layer attribution CVE-2026-9029 Fix available 7.3 HighJune 22, 2026
• grafana Alpine Path traversal in the Tempo and Loki data source plugins CVE-2026-10601 Fix available 5.4 MediumJune 22, 2026
• grafana Alpine Path traversal in the Loki data source plugin CVE-2026-42129 Fix available 7.7 HighJune 22, 2026
• grafana Alpine Query resampling can cause unbounded memory allocations CVE-2026-27879 Fix available 6.5 MediumMarch 27, 2026
• grafana Alpine Grafana Testdata datasource can issue unbounded memory allocations CVE-2026-28375 Fix available 6.5 MediumMarch 27, 2026
• grafana Alpine RCE on Grafana via sqlExpressions CVE-2026-27876 Public exploitFix available 9.1 CriticalMarch 27, 2026
• grafana Alpine OpenFeature evaluation API reads input data with no bounds CVE-2026-27880 Fix available 7.5 HighMarch 27, 2026
• grafana Alpine Public dashboards discloses all direct mode datasources CVE-2026-27877 Fix available 6.5 MediumMarch 27, 2026
• grafana Alpine Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS CVE-2026-33375 Fix available 6.5 MediumMarch 26, 2026
• grafana Alpine Grafana vulnerable to authenticated users bypassing dashboard, folder permissions CVE-2025-3260 Fix available 8.3 HighJune 2, 2025
• grafana Alpine Grafana's datasource proxy API allows authorization checks to be bypassed CVE-2025-3454 Fix available 5.0 MediumMay 5, 2025
• grafana Alpine The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor... CVE-2025-2703 Fix available EPSS 16.0% 6.8 MediumApril 23, 2025
• grafana Alpine Grafana SQL Expressions allow for remote code execution CVE-2024-9264 Public exploitFix available EPSS 97.6% 9.4 CriticalOctober 18, 2024
• grafana Alpine Grafana alerting wrong permission on datasource rule write endpoint CVE-2024-8118 Public exploitFix available 5.1 MediumSeptember 26, 2024
• grafana Alpine Grafana folders admin only permission privilege escalation CVE-2022-36062 Fix available 7.6 HighSeptember 22, 2022
• grafana Alpine Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin CVE-2022-35957 Fix available 6.6 MediumSeptember 20, 2022
• grafana Alpine Grafana Image Renderer leaking files CVE-2022-31176 Fix available 8.3 HighSeptember 2, 2022
• grafana Alpine Grafana account takeover via OAuth vulnerability CVE-2022-31107 Fix available 7.1 HighJuly 15, 2022
• grafana Alpine Stored XSS in Grafana's Unified Alerting CVE-2022-31097 Fix available EPSS 70.1% 7.3 HighJuly 15, 2022
• grafana Alpine Grafana Enterprise datasource network restrictions bypass via HTTP redirects CVE-2022-29170 Public exploitFix available 6.6 MediumMay 20, 2022
• grafana Alpine Exposure of Sensitive Information in Grafana CVE-2022-21713 Fix available 4.3 MediumFebruary 8, 2022
• grafana Alpine Cross Site Request Forgery in Grafana CVE-2022-21703 Fix available 6.3 MediumFebruary 8, 2022
• grafana Alpine Cross site scripting in Grafana proxy CVE-2022-21702 Fix available 6.5 MediumFebruary 8, 2022
• grafana Alpine OAuth Identity Token exposure in Grafana CVE-2022-21673 Fix available 4.3 MediumJanuary 18, 2022
• grafana Alpine Grafana directory traversal for `.cvs` files CVE-2021-43815 Fix available 4.3 MediumDecember 10, 2021
• grafana Alpine Directory Traversal in Grafana CVE-2021-43813 Fix available EPSS 56.6% 4.3 MediumDecember 10, 2021
• grafana Alpine Grafana path traversal CVE-2021-43798 In KEVPublic exploitFix available EPSS 88.5% 7.5 HighDecember 7, 2021
• grafana Alpine Cross organization admin control in Grafana CVE-2021-41244 Fix available 9.1 CriticalNovember 15, 2021
• grafana Alpine One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7... CVE-2021-28148 Fix available 7.5 HighMarch 22, 2021
• grafana Alpine The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x... CVE-2021-28147 Fix available 6.5 MediumMarch 22, 2021
• Show olderLoading…