Skip to content
OpenAdvisories

Package · Go

github.com/grafana/grafana

66 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-41115 Public exploit EPSS 17%

    Incorrect privilege assignment

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled an…

    Grafana Grafana Enterprise github.com/grafana/grafana Web / CMS Go
  • High 7.6
    CVE-2025-4123 Public exploit Scanner template EPSS 97%

    Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerab…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Critical 9.9
    CVE-2024-9264 Public exploit Scanner template EPSS 98%

    Grafana SQL Expressions allow for remote code execution

    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulner…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  • High 7.5
    CVE-2021-43798 Exploited Public exploit Scanner template EPSS 89%

    Grafana path traversal

    Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

    Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
    KEV Oct 9, 2025
  • Medium 5.4
    CVE-2020-11110 Public exploit Scanner template

    Grafana stored XSS

    Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 5.8
    CVE-2020-13379 Public exploit Scanner template EPSS 100%

    Server Side Request Forgery in Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

    github.com/grafana/grafana grafana Alpine Go
  • Medium 5.4
    CVE-2019-13068 Public exploit EPSS 52%

    Grafana Cross-site Scripting vulnerability

    public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

    github.com/grafana/grafana Go
  • Critical 9.8
    CVE-2018-15727 Public exploit EPSS 63%

    Grafana Authentication Bypass

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    grafana github.com/grafana/grafana Ubuntu Go