Grafana vulnerabilities
141 CVEs and advisories name Grafana as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-8118Grafana alerting wrong permission on datasource rule write endpoint
- CVE-2024-8996Grafana Agent Flow on Windows Unquoted service path
- CVE-2024-8975Grafana Alloy on Windows Unquoted service path
- CVE-2024-6322Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account
- CVE-2024-5526Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and inte
- CVE-2024-1313Users outside an organization can delete a snapshot with its key
- CVE-2024-1442User with permissions to create a data source can CRUD all data sources
- CVE-2023-5122SSRF in CSV Datasource Plugin
- CVE-2023-5123Improper Path Sanitization in JSON Datasource Plugin
- CVE-2023-6152A user changing their email after signing up and verifying it can change it without verification in profile settings.
- CVE-2023-3010Grafana is an open-source platform for monitoring and observability.
- CVE-2023-4399Grafana is an open-source platform for monitoring and observability.
- CVE-2023-4457Grafana is an open-source platform for monitoring and observability.
- CVE-2023-4822Grafana is an open-source platform for monitoring and observability.
- CVE-2023-3128Grafana is validating Azure AD accounts based on the email claim.
- CVE-2023-2183Grafana is an open-source platform for monitoring and observability.
- CVE-2023-2801Grafana is an open-source platform for monitoring and observability.
- CVE-2023-1387Grafana is an open-source platform for monitoring and observability.
- CVE-2023-1410Stored XSS in Graphite FunctionDescription tooltip
- CVE-2023-22462Stored XSS in Grafana Text plugin
- CVE-2023-0594Grafana is an open-source platform for monitoring and observability.
- CVE-2023-0507Grafana is an open-source platform for monitoring and observability.
- CVE-2022-23498When query caching is enabled in Grafana users can query another users session
- CVE-2022-23552Grafana stored XSS in FileUploader component
- CVE-2022-39324Grafana vulnerable to spoofing originalUrl of snapshots
- CVE-2022-46156Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
- CVE-2022-39307Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
- CVE-2022-39306Grafana contains Improper Input Validation
- CVE-2022-39328Grafana vulnerable to race condition allowing privilege escalation
- CVE-2022-39229Grafana users with email as a username can block other users from signing in