Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.Oct 15, 2026
- UnknownImportant: grafana security updateOct 15, 2026
- High7.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.EPSS 0.6%Aug 24, 2026
- High8.1When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.May 13, 2026
- Medium6.5A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem.May 13, 2026
- Medium6.5Using the $__timeGroup macro, one can achieve an OOM by overloading the server.May 13, 2026
- High7.1An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.May 13, 2026
- High7.4When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.May 13, 2026
- Medium6.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory.May 13, 2026
- Medium6.5Any Editor could delete any snapshot, even if they have no access to read or write them.May 13, 2026
- Medium6.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error.May 13, 2026
- Medium6.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions.May 13, 2026
- Medium4.3Editors could delete any annotation, even those they do not have read access to.May 13, 2026
- High7.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.Apr 24, 2026
- Low3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records.Apr 15, 2026
- Medium5.3The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the…Apr 15, 2026
- Critical9.1Pyroscope is an open-source continuous profiling database.Apr 15, 2026
- Low1.3In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receive…Apr 15, 2026
- Medium6.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.Mar 27, 2026
- High7.5The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.Mar 27, 2026
- Medium6.5A resample query can be used to trigger out-of-memory crashes in Grafana.Mar 27, 2026
- High7.5When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.Mar 27, 2026
- Critical9.1A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE).Mar 27, 2026
- High7.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtai…Mar 26, 2026
- Medium6.5The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memo…Mar 26, 2026
30 records · page 1 of 2
PreviousNext