Skip to contentGrafana vulnerabilities
Newest
- grafana, grafana oss +1 moreAuth Proxy IPv6 whitelist bypassCVE-2026-33376Fix available7.4 High
- grafana, grafana oss +1 moreSQL Expressions Read File From DiskCVE-2026-33380Fix available6.3 Medium
- grafana, grafana oss +1 moreBAC in Snapshot API allows deletion of unauthorized dashboard snapshotsCVE-2026-28380Fix available6.5 Medium
- grafana oss, grafana +1 moreUsers can generate Service Account tokens after permissions removalCVE-2026-33381Fix available5.9 Medium
- grafana, grafana oss +1 moreDashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard AdminCVE-2026-33377Fix available7.1 High
- grafana, grafana oss +1 moreGrafana Live push endpoint allows unbounded memory allocation leading to OOMCVE-2026-28376Fix available6.5 Medium
- grafana, grafana oss +1 moreViewer-triggered race condition in Grafana Live leads to complete server crashCVE-2026-28379Fix available6.5 Medium
- grafana tempo, enterprise traces (get), red hat logging subsystem for red hat openshift +13 more +15 moreTempo query limit results in unbounded memory allocationCVE-2026-21728Fix available7.5 High
- grafana lokiLoki Path Traversal - CVE-2021-36156 BypassCVE-2026-21726Fix available5.3 Medium
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionCVE-2025-41118Fix available9.1 Critical
- grafana, grafana correlations +1 moreGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 RecordCVE-2026-21727Fix available3.3 Low
- grafana, grafana alerting +1 moreGrafana Alerting Editors can edit destination of webhooks they did not createCVE-2025-12141Fix available1.3 Low
- grafanaQuery resampling can cause unbounded memory allocationsCVE-2026-27879Fix available6.5 Medium
- grafanaGrafana Testdata datasource can issue unbounded memory allocationsCVE-2026-28375Fix available6.5 Medium
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreRCE on Grafana via sqlExpressionsCVE-2026-27876Public exploitFix available9.1 Critical
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreOpenFeature evaluation API reads input data with no boundsCVE-2026-27880Fix available7.5 High
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasourcesCVE-2026-27877Fix available6.5 Medium
- grafana, grafana oss +1 moreMissing Protected-field Authorization in Provisioning Contact Points APICVE-2026-21724Fix available5.4 Medium
- grafana, grafana oss +1 moreGrafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoSCVE-2026-33375Fix available6.5 Medium
- grafana tempoS3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)CVE-2026-28377Fix available7.5 High
- grafanaAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by NameCVE-2026-21725Fix available2.6 Low
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +2 moreXSS in Grafana Explore stack traceCVE-2025-41117Fix available6.8 Medium
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +2 morePublic Dashboards time range restriction on annotations can be bypassedCVE-2026-21722Fix available5.3 Medium
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationCVE-2026-21721Public exploitFix available8.1 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +5 more +7 moreUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outCVE-2026-21720Fix available7.5 High
- grafana, grafana enterprise +1 moreIncorrect privilege assignmentCVE-2025-41115Public exploitFix availableEPSS 17.5%10.0 Critical
- grafana grafana-image-rendererArbitrary Code Execution in Grafana Image Renderer PluginCVE-2025-11539Fix available9.9 Critical
- grafana grafana-zabbix-pluginRegex DoS in Grafana Zabbix PluginCVE-2025-10630Fix available4.3 Medium
- grafana grafana-infinity-datasourceSSRF in Infinity Datasource PluginCVE-2025-8341Fix available5.0 Medium
- grafanaAn open redirect vulnerability has been identified in Grafana OSS organization switching...CVE-2025-6197Fix availableEPSS 70.1%4.2 Medium
- grafanaGrafana is vulnerable to XSS attacks through open redirects and path traversalCVE-2025-6023Fix availableEPSS 57.7%7.6 High
- grafanaGrafana's insecure DingDing Alert integration exposes sensitive informationCVE-2025-3415Fix available4.3 Medium
- grafanaVery long unicode dashboard title or panel name can hang the frontendCVE-2025-1088Fix available2.7 Low
- grafanaGrafana vulnerable to authenticated users bypassing dashboard, folder permissionsCVE-2025-3260Fix available8.3 High
- grafanaAn access control vulnerability was discovered in Grafana OSS where an Organization administrator...CVE-2025-3580Fix available5.5 Medium
- grafanaGrafana Cross-Site-Scripting (XSS) via custom loaded frontend pluginCVE-2025-4123Public exploitFix availableEPSS 97.1%7.6 High
- grafana, grafana enterprise +1 moreGrafana's datasource proxy API allows authorization checks to be bypassedCVE-2025-3454Fix available5.0 Medium
- grafana, grafana enterprise +1 moreThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability.
A user with Editor...CVE-2025-2703Fix availableEPSS 16.0%6.8 Medium
- grafanaGrafana Alerting VictorOps integration could be exposed to users with Viewer permissionCVE-2024-11741Fix available4.3 Medium
- grafanaGrafana org admin can delete pending invites in different orgCVE-2024-10452Fix available2.2 Low
- grafanaGrafana SQL Expressions allow for remote code executionCVE-2024-9264Public exploitFix availableEPSS 97.6%9.4 Critical
- grafanaGrafana alerting wrong permission on datasource rule write endpointCVE-2024-8118Public exploitFix available5.1 Medium
- grafana agent, agent flow, agent flow windows +2 moreGrafana Agent Flow on Windows Unquoted service pathCVE-2024-8996Fix available7.3 High
- grafana alloyGrafana Alloy on Windows Unquoted service pathCVE-2024-8975Fix available7.3 High
- grafana, grafana enterprise +1 moreGrafana plugin data sources vulnerable to access control bypassCVE-2024-6322Fix available4.4 Medium
- grafana oncallGrafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call...CVE-2024-55267.7 High
- grafanaUsers outside an organization can delete a snapshot with its keyCVE-2024-1313Fix available6.5 Medium
- grafanaUser with permissions to create a data source can CRUD all data sourcesCVE-2024-1442Fix available6.0 Medium
- grafana, grafana grafana-csv-datasource +1 moreSSRF in CSV Datasource PluginCVE-2023-5122Fix available5.0 Medium
- grafana grafana-json-datasource, json api data source +1 moreImproper Path Sanitization in JSON Datasource PluginCVE-2023-51238.0 High
- Show moreLoading…