Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

grafana — Vulnerabilities & Security Advisories 57

All 57 CVE vulnerabilities found in grafana, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for Grafana, an open-source data visualization platform, specifically focusing on identified security weaknesses and associated tags. The collection encompasses various flaw types, including injection flaws, authentication bypasses, and buffer overflows, covering reported advisories spanning the product's active release history. Readers can use this resource to track Grafana's security advisories, understand specific weakness classes, and review the product's complete vulnerability history. The data provides a structured view of past security incidents, enabling teams to identify recurring patterns, assess risk exposure, and verify whether specific issues have been resolved in recent patches. By consolidating these records, the page serves as a centralized reference for security professionals who need to audit Grafana's historical security posture. It allows for quick identification of unresolved risks or recurring defects that may still affect current installations. This aggregation supports proactive maintenance planning and helps organizations align their patching strategies with the most prevalent vulnerability types observed in the Grafana ecosystem. The entries are organized by weakness type and timeframe, facilitating efficient navigation through the accumulated security history without requiring a search for individual CVE identifiers within the primary display.

Vendor: grafana

CVE ID Title CVSS Severity Published
CVE-2026-27879 Query resampling can cause unbounded memory allocations 6.5 Medium 2026-03-27
CVE-2026-28375 Grafana Testdata datasource can issue unbounded memory allocations 6.5 Medium 2026-03-27
CVE-2026-27876 RCE on Grafana via sqlExpressions 9.1 Critical 2026-03-27
CVE-2026-27880 OpenFeature evaluation API reads input data with no bounds 7.5 High 2026-03-27
CVE-2026-27877 Public dashboards discloses all direct mode datasources 6.5 Medium 2026-03-27
CVE-2026-21725 Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name 2.6 Low 2026-02-25
CVE-2025-6197 Grafana OSS 安全漏洞 CWE-601 4.2 Medium 2025-07-18
CVE-2025-6023 Grafana OSS 安全漏洞 CWE-601 7.6 High 2025-07-18
CVE-2025-3415 Grafana 安全漏洞 CWE-200 4.3 Medium 2025-07-17
CVE-2025-1088 Very long unicode dashboard title or panel name can hang the frontend CWE-20 2.7 Low 2025-06-18
CVE-2025-3454 Grafana 安全漏洞 CWE-285 5.0 Medium 2025-06-02
CVE-2025-3260 Grafana 安全漏洞 CWE-863 8.3 High 2025-06-02
CVE-2025-3580 Grafana OSS 安全漏洞 CWE-284 5.5 Medium 2025-05-23
CVE-2025-4123 Grafana 安全漏洞 CWE-79 7.6 High 2025-05-22
CVE-2025-2703 Grafana 安全漏洞 CWE-79 6.8 Medium 2025-04-23
CVE-2024-11741 Grafana 安全漏洞 CWE-200 4.3 Medium 2025-01-31
CVE-2024-10452 Grafana 安全漏洞 CWE-639 2.2 Low 2024-10-29
CVE-2024-9264 Grafana SQL Expressions allow for remote code execution CWE-94 9.9 Critical 2024-10-18
CVE-2024-8118 Grafana alerting wrong permission on datasource rule write endpoint CWE-653 4.3AI Medium AI 2024-09-26
CVE-2024-6322 Grafana 安全漏洞 CWE-266 4.4 Medium 2024-08-20
CVE-2024-1313 Users outside an organization can delete a snapshot with its key CWE-639 6.5 Medium 2024-03-26
CVE-2024-1442 User with permissions to create a data source can CRUD all data sources CWE-269 6.0 Medium 2024-03-07
CVE-2023-6152 Grafana 安全漏洞 CWE-863 5.4 Medium 2024-02-13
CVE-2023-3128 Grafana 安全漏洞 CWE-290 9.4 Critical 2023-06-22
CVE-2023-2183 Grafana 安全漏洞 CWE-284 4.1 Medium 2023-06-06
CVE-2023-2801 Grafana 安全漏洞 CWE-820 7.5 High 2023-06-06
CVE-2023-1387 Grafana 安全漏洞 CWE-200 4.2 Medium 2023-04-26
CVE-2023-1410 Stored XSS in Graphite FunctionDescription tooltip CWE-79 6.2 Medium 2023-03-23
CVE-2023-22462 Stored XSS in Grafana Text plugin CWE-79 6.4 Medium 2023-03-02
CVE-2023-0594 Grafana 跨站脚本漏洞 CWE-79 7.3 High 2023-03-01

All 57 known CVE vulnerabilities affecting grafana with full Chinese analysis, references, and POCs where available.