Total
104 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27880 | 1 Grafana | 1 Grafana | 2026-07-15 | N/A | 7.5 HIGH |
| The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes. | |||||
| CVE-2026-27877 | 1 Grafana | 1 Grafana | 2026-07-15 | N/A | 6.5 MEDIUM |
| When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security. | |||||
| CVE-2026-27876 | 1 Grafana | 1 Grafana | 2026-07-15 | N/A | 9.1 CRITICAL |
| A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive) to 12.2.8 (exclusive): 12.2.8 has the fix. - 12.3.0 (inclusive) to 12.3.6 (exclusive): 12.3.6 has the fix. - 12.4.0 (inclusive) to 12.4.2 (exclusive): 12.4.2 has the fix. 13.0.0 and above also have the fix: no v13 release is affected. | |||||
| CVE-2026-21720 | 1 Grafana | 1 Grafana | 2026-07-15 | N/A | 7.5 HIGH |
| Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems. | |||||
| CVE-2026-42127 | 1 Grafana | 1 Grafana | 2026-07-10 | N/A | 7.5 HIGH |
| The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability. | |||||
| CVE-2026-28378 | 1 Grafana | 1 Grafana | 2026-07-10 | N/A | 3.1 LOW |
| The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers. | |||||
| CVE-2026-33375 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.5 MEDIUM |
| The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container. | |||||
| CVE-2026-28375 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.5 MEDIUM |
| A testdata data-source can be used to trigger out-of-memory crashes in Grafana. | |||||
| CVE-2026-27879 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.5 MEDIUM |
| A resample query can be used to trigger out-of-memory crashes in Grafana. | |||||
| CVE-2026-21725 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 2.6 LOW |
| A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by default. - The datasource can now be re-deleted by the attacker. - Once 30 seconds are up, the attack is spent and cannot be repeated. - No datasource with any other UID can be attacked. | |||||
| CVE-2026-21724 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. | |||||
| CVE-2026-21722 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 5.3 MEDIUM |
| Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard. | |||||
| CVE-2025-4123 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 7.6 HIGH |
| A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive. | |||||
| CVE-2025-41117 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.8 MEDIUM |
| Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever. | |||||
| CVE-2024-9264 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 9.9 CRITICAL |
| The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | |||||
| CVE-2024-1442 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.0 MEDIUM |
| A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization. | |||||
| CVE-2024-10452 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 2.2 LOW |
| Organization admins can delete pending invites created in an organization they are not part of. | |||||
| CVE-2023-6152 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 5.4 MEDIUM |
| A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | |||||
| CVE-2023-5122 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 5.0 MEDIUM |
| Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g. https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator | |||||
| CVE-2023-4822 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.7 MEDIUM |
| Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of. | |||||