Security

Security Advisories

Showing 24 results, page 3 of 6

Published CVE records
CVESeverity (CVSS)Advisory Title
CVE-2026-27878Medium (6.5)Tempo denial of service via TraceQL exemplars hint (TraceQL query execution)
CVE-2026-28377High (7.5)S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint
CVE-2026-21725Low (2.6)Authorization bypass in Grafana datasource deletion
CVE-2026-21722Medium (5.3)Public Dashboards time range restriction on annotations can be bypassed
CVE-2025-41117Medium (6.8)XSS in Grafana Explore stack trace
CVE-2026-21727Low (3.3)Cross-Tenant Legacy Correlation Disclosure and Deletion
CVE-2026-21721High (8.1)Cross-dashboard privilege escalation via permission management
CVE-2026-21720High (7.5)Unauthenticated DoS in avatar cache in Grafana
CVE-2026-21726Medium (5.3)Open Redirect Loki Path Traversal - CVE-2021-36156 Bypass
CVE-2025-41118Critical (9.1)Exposure of Storage Secret in Pyroscope
CVE-2025-12141Low (1.3)Grafana Alerting Editors can edit destination of webhooks they did not create
CVE-2025-41115Critical (10.0)Incorrect privilege assignment
CVE-2025-41116Low (2.1)Incorrect OAuth Passthrough in Grafana Databricks Datasource
CVE-2025-3717Low (2.1)Incorrect OAuth Passthrough in Grafana Snowflake Datasource
CVE-2025-11539Critical (9.9)Arbitrary Code Execution in Grafana Image Renderer Plugin
CVE-2025-10630Low (4.3)Regex DoS in Zabbix Plugin
CVE-2025-8341Medium (6.1)SSRF in Infinity Plugin in Grafana
CVE-2025-6197Medium (4.2)Open Redirect in Organization Switching in Grafana
CVE-2025-6023High (7.6)XSS in Scripted Dashboards in Grafana
CVE-2025-3415Medium (4.3)Information Disclosure in DingDing Integration in Grafana
CVE-2025-1088Low (2.7)DoS in Dashboard Titles in Grafana
CVE-2025-3260High (8.3)Authorization Bypass in Dashboard API in Grafana
CVE-2025-3454Medium (5.0)Authorization Bypass in Data Source Proxy in Grafana
CVE-2025-3580Medium (5.5)Privilege Escalation in Admin Management in Grafana

Security Advisories | Grafana Labs