5115 matches found
Grafana - Exposes DingDing API Keys
An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
EUVD-2026-51861
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342
ArcadeDB is affected in versions before 26.7.2 where an authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints, failing to validate database access permissions. Attackers can call affected endpoints with arbitrary database parameters to access and m...
Grafana <= 6.7.1 - Cross-Site Scripting
Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...
Grafana - Improper Access Control
Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service. id: CVE-2019-15043 info: name: Grafana - Improper Access Control author: Joshua Rogers severity: high description: | Grafana 2.x...
Grafana v8.x - Arbitrary File Read
Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin. id: CVE-2021-43798 info: name: Grafana v8.x - Arbitrary File Read autho...
Grafana & Zabbix Integration - Credentials Disclosure
Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the apijsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search...
RHSA-2026:47722 Red Hat Security Advisory: grafana security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:47721 Red Hat Security Advisory: grafana-pcp security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:47716 Red Hat Security Advisory: grafana-pcp security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:47714 Red Hat Security Advisory: grafana security, bug fix, and enhancement update
Bulletin has no description...
CLEANSTART-2026-YP95633 Security fixes in grafana 12.2.10-r1
Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...
CLEANSTART-2026-RY66554 Security fixes in grafana-mimir-fips 3.0.4-r1
Package grafana-mimir-fips version 3.0.4-r1 fixes 1 vulnerabilities: CVE-2026-34986...
CLEANSTART-2026-QM60808 Security fixes in grafana-alloy 1.14.0-r0
Package grafana-alloy version 1.14.0-r0 fixes 2 vulnerabilities: CVE-2026-1229, CVE-2026-33186...
CLEANSTART-2026-MO12071 Security fixes in grafana-agent-operator 0.44.8-r0
Package grafana-agent-operator version 0.44.8-r0 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...