| 2026-05-26 |
Grafana -- Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS |
| Grafana -- Grafana Testdata datasource can issue unbounded memory allocations |
| Grafana -- OpenFeature evaluation API reads input data with no bounds |
| Grafana -- Public dashboards discloses all direct mode datasources |
| Grafana -- Public Dashboards time range restriction on annotations can be bypassed |
| Grafana -- Query resampling can cause unbounded memory allocations |
| Grafana -- RCE on Grafana via sqlExpressions |
| Grafana -- XSS in Grafana Explore stack trace |
| 2025-06-18 |
Grafana -- DingDing contact points exposed in Grafana Alerting |
| 2025-05-27 |
grafana -- XSS vulnerability |
| 2025-05-23 |
Grafana -- User deletion issue |
| 2025-04-24 |
Grafana -- Authorization bypass in data source proxy API |
| Grafana -- Bypass Viewer and Editor permissions |
| Grafana -- DOM XSS vulnerability |
| 2024-03-11 |
Grafana -- Data source permission escalation |
| 2024-02-20 |
Grafana -- Email verification is not required after email change |
| 2023-06-23 |
Grafana -- Account takeover / authentication bypass |
| 2023-06-07 |
Grafana -- Broken access control: viewer can send test alerts |
| Grafana -- Grafana DS proxy race condition |
| 2023-04-26 |
Grafana -- Critical vulnerability in golang |
| Grafana -- Exposure of sensitive information to an unauthorized actor |
| 2023-03-29 |
Grafana -- Stored XSS in Graphite FunctionDescription tooltip |
| 2023-03-01 |
Grafana -- Stored XSS in geomap panel plugin via attribution |
| Grafana -- Stored XSS in text panel plugin |
| Grafana -- Stored XSS in TraceView panel |
| 2023-02-09 |
Grafana -- Spoofing originalUrl of snapshots |
| Grafana -- Stored XSS in ResourcePicker component |
| 2022-11-12 |
Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins |
| Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins |
| Grafana -- Improper authentication |
| Grafana -- Plugin signature bypass |
| Grafana -- Privilege escalation |
| Grafana -- Privilege escalation |
| Grafana -- Username enumeration |
| 2022-09-21 |
Grafana -- Privilege escalation |
| 2022-09-01 |
Grafana -- Unauthorized file disclosure |
| 2022-07-15 |
Grafana -- OAuth Account Takeover |
| Grafana -- Stored XSS |
| 2021-12-12 |
Grafana -- Directory Traversal |
| Grafana -- Directory Traversal |
| 2021-12-11 |
Grafana -- Incorrect Access Control |
| Grafana -- Path Traversal |
| Grafana -- XSS |
| 2021-10-06 |
Grafana -- Snapshot authentication bypass |