Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including: - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily...

Grafana Labs 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including: - A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser o...

CLEANSTART-2026-LC55153 Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, CVE-2026-55170, CVE-2026-55689, ghsa-8396-jffm-qx4w, ghsa-cf98-j28v-49v6, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-hcxc-wf8j-23hv, ghsa-mpwr-8vm7-h73f, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1, 13.1.0-r1

Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details...

Grafana 11.6.x < 11.6.3 Multiples Vulnerabilities

According to its self-reported version, the Grafana install hosted on the remote host is prior to 11.3.8, or 11.4.x prior to 11.4.6, or 11.5.x prior to 11.5.6, or 11.6.x prior to 11.6.3, or 12.0.x prior to 12.0.2, or 12.1.x prior to 12.1.2. It is, therefore, affected by multiples vulnerabilities....

EUVD-2022-33572

Malicious code in bioql PyPI...

EUVD-2024-1473

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-1000816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting XSS vulnerability in Influxdb and Graphite query editor that can result in Running...

Linux Distros Unpatched Vulnerability : CVE-2018-15727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid remember me cookie knowing onl...

U.S. Dept Of Defense: CVE‑2025‑4123 — Grafana Open Redirect → Stored XSS → SSRF (Full Read) at ██████

A vulnerability, identified as CVE-2025-4123, was discovered in Grafana OSS and Enterprise versions 8.x through 12.x. The vulnerability allowed unauthenticated attackers to chain multiple flaws, including an open redirect through path traversal in the public redirect handler, stored cross-site...

PT-2025-25859 · Google +2 · Chromium +2

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 11.6.2 Description: The issue is caused by an excessively long dashboard title or panel name, leading to Improper Input Validation vulnerability in Grafana, which affects Chromium browsers and causes them to become...

Grafana 10.1.x < 10.1.8 Improper Privilege Management

According to its self-reported version, the Grafana install hosted on the remote host is 8.5.x earlier than 9.5.7, or 10.0.x earlier than 10.0.12, or 10.1.x earlier than 10.1.8, or 10.2.x earlier than 10.2.5, or 10.3.x earlier than 10.3.4. It is, therefore, affected by a improper privilege...

Grafana 9.3.x < 9.3.4 Cross-site Scripting

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 9.2.10, or 9.3.x earlier than 9.3.4. It is, therefore, affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the...

Grafana 11.4.x < 11.4.5 Improper Access Control

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.19, or 11.2.x earlier than 11.2.10, or 11.3.x earlier than 11.3.7, or 11.4.x earlier than 11.4.5, or 11.5.x earlier than 11.5.5, or 11.6.x earlier than 11.6.2, or 12.0.x earlier than 12.0.1...

Grafana 11.6.x < 11.6.2 Improper Access Control

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.19, or 11.2.x earlier than 11.2.10, or 11.3.x earlier than 11.3.7, or 11.4.x earlier than 11.4.5, or 11.5.x earlier than 11.5.5, or 11.6.x earlier than 11.6.2, or 12.0.x earlier than 12.0.1...

Grafana 10.0.x < 10.0.11 Incorrect Authorization

According to its self-reported version, the Grafana install hosted on the remote host is 9.5.x earlier than 9.5.16, or 10.0.x earlier than 10.0.11, or 10.1.x earlier than 10.1.7, or 10.2.x earlier than 10.2.4, or 10.3.x earlier than 10.3.3. It is, therefore, affected by a incorrect authorization...

Grafana < 10.4.15 Exposure Of Sensitive Information To An Unauthorized Actor

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 10.4.15, or earlier than 11.0.11, or earlier than 11.1.11, or earlier than 11.2.6, or earlier than 11.3.3, or earlier than 11.4.1. It is, therefore, affected by a exposure of sensitive informatio...

Grafana 10.0.x < 10.0.12 Improper Privilege Management

According to its self-reported version, the Grafana install hosted on the remote host is 8.5.x earlier than 9.5.7, or 10.0.x earlier than 10.0.12, or 10.1.x earlier than 10.1.8, or 10.2.x earlier than 10.2.5, or 10.3.x earlier than 10.3.4. It is, therefore, affected by a improper privilege...

PT-2025-17602 · Grafana +1 · Grafana +1

Name of the Vulnerable Software and Affected Versions: Grafana versions v0alpha1 through v2alpha1 Description: A security issue in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder permissions. The impact includes viewers being able to view all...

PT-2025-1685 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 10.4.15 Grafana versions prior to 11.0.11 Grafana versions prior to 11.1.11 Grafana versions prior to 11.2.6 Grafana versions prior to 11.3.3 Grafana versions prior to 11.4.1 Grafana versions prior to 11.5.0...

PT-2024-7005

Name of the Vulnerable Software and Affected Versions Grafana versions prior to v11.0.6+security-01 Grafana versions prior to v11.1.7+security-01 Grafana versions prior to v11.2.2+security-01 Description The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queri...