CVE Database

Date	CVE	Title
2022-01-18	CVE-2022-21673	Forward OAuth Identity Token can allow users to access some data sources
2022-02-08	CVE-2022-21703	Grafana Cross Site Request Forgery
2022-02-08	CVE-2022-21702	Grafana proxy XSS
2022-02-08	CVE-2022-21713	Grafana Teams API IDOR
2022-04-12	CVE-2022-24812	Grafana Enterprise fine-grained access control API Key privilege escalation
2022-05-19	CVE-2022-29170	Grafana Enterprise datasource network restrictions bypass via HTTP redirects
2022-07-14	CVE-2022-31107	Grafana account takeover via OAuth vulnerability
2022-07-14	CVE-2022-31097	Stored XSS in Unified Alerting
2022-08-30	CVE-2022-31176	Grafana Image Renderer leaking files
2022-09-20	CVE-2022-35957	Escalation from admin to server admin when auth proxy is used
2022-09-20	CVE-2022-36062	Grafana folders admin only permission privilege escalation
2022-10-12	CVE-2022-39201	Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
2022-10-12	CVE-2022-31130	Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
2022-10-12	CVE-2022-31123	Plugin signature bypass
2022-10-12	CVE-2022-39229	Using email as a username can block other users from signing in
2022-11-08	CVE-2022-39306	Email addresses and usernames can not be trusted
2022-11-08	CVE-2022-39328	Race condition allowing privilege escalation
2022-11-08	CVE-2022-39307	User enumeration via forget password
2023-01-26	CVE-2022-39324	Spoofing originalUrl of snapshots
2023-01-26	CVE-2022-23552	Stored XSS in ResourcePicker component
2023-02-01	CVE-2022-23498	Use of Cache Containing Sensitive Information
2023-02-28	CVE-2023-0594	Stored XSS in TraceView Panel
2023-02-28	CVE-2023-22462	Text panel plugin XSS
2023-02-28	CVE-2023-0507	XSS In Geomap Via Attribution
2023-03-22	CVE-2023-1410	Stored XSS in Graphite FunctionDescription tooltip
2023-04-26	CVE-2023-1387	JWT URL-login flow leaks token to data sources through request parameter in proxy requests