Grafana vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
67 matching records
- Medium5.4The grafanacubism-panel plugin allows use of cubism.js in Grafana.Check if you run itEPSS 0.28%Mar 11, 2026
- Low2.0A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so.Check if you run itEPSS 0.18%Feb 25, 2026
- Critical10.0SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecCheck this weekEPSS 17.50%Nov 21, 2025
- Low2.1When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a singlCheck if you run itEPSS 0.29%Nov 11, 2025
- Low2.1When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a singleCheck if you run itEPSS 0.29%Nov 11, 2025
- Medium4.3Grafana is an open-source platform for monitoring and observability.Check if you run itEPSS 0.36%Sep 19, 2025
- UnknownGrafana Labs Grafana Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 1.08%Aug 7, 2025
- Medium5.0Grafana is an open-source platform for monitoring and observability.Check if you run itEPSS 0.34%Aug 4, 2025
- Medium4.2An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.Check this weekEPSS 70.14%Jul 18, 2025
- High7.6An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.Check this weekEPSS 57.74%Jul 18, 2025
- High8.3A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions.Check if you run itEPSS 0.56%Jun 2, 2025
- Medium6.1Grafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 97.08%May 22, 2025
- UnknownGrafana Labs Grafana Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 99.86%Mar 7, 2024
- UnknownGrafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 85.40%May 31, 2022
- High7.5Grafana Path Traversal VulnerabilityPatch nowKEVEPSS 88.50%Dec 7, 2021
- High7.3Grafana Authentication Bypass VulnerabilityPatch nowKEVEPSS 99.93%Oct 5, 2021
- High7.5Grafana Snapshot Feature Remote API Denial of ServicePatch nowKEVEPSS 83.04%Mar 18, 2021