Advisories · Technology
Grafana.
Every CVE that names Grafana among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Query resampling can cause unbounded memory allocations
- Grafana
- Denial of service
- CVSS 6.5 Medium
Grafana Testdata datasource can issue unbounded memory allocations
- Grafana
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
RCE on Grafana via sqlExpressions
- Grafana
- SQL injection
- Code injection
- CVSS 7.5 High
OpenFeature evaluation API reads input data with no bounds
- Grafana
- Memory corruption
- Denial of service
- CVSS 2.6 Low
Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name
- Grafana
- Race condition
- CVSS 4.2 Medium
Open redirect in Grafana
- Grafana
- Open redirect
- CVSS 5.5 Medium
Improper access control in Grafana
- Grafana
- Broken access control
- CVSS 6.8 Medium
Cross-site scripting in Grafana and others
- Grafana
- Grafana Enterprise
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grafana alerting wrong permission on datasource rule write endpoint
- Grafana
- CWE-653
- CVSS 4.2 Medium
Information disclosure in Grafana and others
- Grafana
- Grafana Enterprise
- Information disclosure
- CVSS 7.1 High
When query caching is enabled in Grafana users can query another users session
- grafana
- Information disclosure
- CVSS 7.3 High
Grafana stored XSS in FileUploader component
- grafana
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
Grafana Enterprise datasource network restrictions bypass via HTTP redirects
- grafana
- Open redirect
- CVSS 8.0 High
FGAC API Key privilege escalation in Grafana
- grafana
- Privilege escalation
- CVSS 4.3 Medium
OAuth Identity Token exposure in Grafana
- grafana
- Information disclosure
- CVSS 4.3 Medium
Directory Traversal in Grafana
- grafana
- Path traversal