| Grafana legacy correlations allow cross-tenant disclosure and deletionCVE-2026-21727 · GHSA-P5X9-J974-RPFPVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bugCVE-2026-9029 · GHSA-9G84-39MM-Q4P3Version ranges need review. |
github.com/grafana/grafana |
Go |
High
|
Fix reported |
|
| Grafana: Path traversal in the Tempo and Loki data source pluginsCVE-2026-10601 · GHSA-9493-H4F5-633XVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: Pre-authentication denial of service in the public dashboard query handlerCVE-2026-42127 · GHSA-3W66-95M3-8JXGVersion ranges need review. |
github.com/grafana/grafanaRed Hat Ceph Storage 5/rhceph/rhceph-5-dashboard-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.CVE-2026-42129 · GHSA-F74P-CWHP-X2WXVersion ranges need review. |
github.com/grafana/grafana |
Go |
High
|
Fix reported |
|
| Grafana Arbitrary File ReadCVE-2019-19499 · GHSA-4PWP-CX67-5CPXVersion ranges need review. |
github.com/grafana/grafanaOpenShift Service Mesh 1/servicemesh-grafana |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana XSS via a column styleCVE-2018-18624 · GHSA-9HV8-4FRF-CPRFVersion ranges need review. |
github.com/grafana/grafanaOpenShift Service Mesh 1/servicemesh-grafana |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissionsCVE-2026-21724 · GHSA-7G92-G4VH-HP84Version ranges need review. |
github.com/grafana/grafana |
Go |
Medium
|
Fix reported |
|
| Grafana has a Cross-site Scripting issueCVE-2025-41117 · GHSA-CQP7-WF4C-3XGCVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: Users can generate Service Account tokens after permissions removalCVE-2026-33381 · GHSA-WFHV-MJ62-F5XHVersion ranges need review. |
github.com/grafana/grafanaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana: SQL Expressions Read File From DiskCVE-2026-33380 · GHSA-GXCP-JJXH-RWP4Version ranges need review. |
github.com/grafana/grafanaRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana public dashboards disclose all direct mode datasourcesCVE-2026-27877 · GHSA-3Q27-7QJQ-P9C5Version ranges need review. |
github.com/grafana/grafana |
Go |
Medium
|
Fix reported |
|
| Grafana Cross-Site-Scripting (XSS) via custom loaded frontend pluginCVE-2025-4123 · GHSA-Q53Q-GXQ9-MGRJVersion ranges need review. |
github.com/grafana/grafana |
Go |
High
|
Fix reported |
|
| Grafana: Users outside an organization can delete a snapshot with its keyCVE-2024-1313 · GHSA-67RV-QPW2-6QRRVersion ranges need review. |
github.com/grafana/grafanaRed Hat Ceph Storage 6/rhceph/rhceph-6-dashboard-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Grafana Race condition allowing privilege escalationCVE-2022-39328 · GHSA-VQC4-MPJ8-JXCHVersion ranges need review. |
github.com/grafana/grafana |
Go |
Critical
|
Fix reported |
|
| Grafana XSS via the OpenTSDB datasourceCVE-2020-13430 · GHSA-7M2X-QHRQ-RP8HVersion ranges need review. |
github.com/grafana/grafanaRed Hat Ceph Storage 2/grafana |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana Stored Cross-site Scripting in Unified AlertingCVE-2022-31097 · GHSA-VW7Q-P2QG-4M5FVersion ranges need review. |
github.com/grafana/grafanaOpenShift Service Mesh 2.0/servicemesh-grafana |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana vulnerable to authenticated users bypassing dashboard, folder permissionsCVE-2025-3260 · GHSA-3PX7-C4J3-576RVersion ranges need review. |
github.com/grafana/grafana |
Go |
High
|
Fix reported |
|
| Grafana stored XSSCVE-2020-11110 · GHSA-XR3X-62QW-VC4WVersion ranges need review. |
github.com/grafana/grafanaOpenShift Service Mesh 1/servicemesh-grafana |
GoRed Hat |
Medium
|
Fix reported |
|
| Grafana's insecure DingDing Alert integration exposes sensitive informationCVE-2025-3415 · GHSA-46M5-8HPJ-P5P5Version ranges need review. |
github.com/grafana/grafana |
Go |
Medium
|
Fix reported |
|
