GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2026-6541 Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana

Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...

GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Stored Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to map attributes in the Geomap plugin which library does not properly sanitize, allowing an attacker with an editor role to inject and execute malicious JavaScript. If an admin user clicks on the m...

Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary Javascript through HTML links on the dashboard...