[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwIZU6Q5QHSHvsU99YIMCWXy9I8jikgzH_l2pQGEJYfQ":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":78,"kevVulnerabilities":143,"topProductsByCves":154,"seoMetadata":165,"meta":174},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":77},12673,"grafana",13,91,2,1082,"2026-03-27","g",[16,20,26,31,36,41,46,50,54,59,63,67,72],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},51565,502,77,{"id":21,"product_name":22,"version_count":23,"cve_count":11,"kev_count":24,"last_cve_update":25},51563,"enterprise_metrics",11,0,"2022-12-20",{"id":27,"product_name":28,"version_count":29,"cve_count":11,"kev_count":24,"last_cve_update":30},51570,"piechart-panel",21,"2020-05-24",{"id":32,"product_name":33,"version_count":34,"cve_count":11,"kev_count":24,"last_cve_update":35},51561,"agent",109,"2024-09-25",{"id":37,"product_name":38,"version_count":29,"cve_count":39,"kev_count":24,"last_cve_update":40},51568,"loki",1,"2021-08-03",{"id":42,"product_name":43,"version_count":44,"cve_count":39,"kev_count":24,"last_cve_update":45},51569,"oncall",281,"2024-06-05",{"id":47,"product_name":48,"version_count":24,"cve_count":39,"kev_count":24,"last_cve_update":49},51571,"synthetic_monitoring_agent","2022-11-30",{"id":51,"product_name":52,"version_count":24,"cve_count":39,"kev_count":24,"last_cve_update":53},51572,"tempo","2026-03-26",{"id":55,"product_name":56,"version_count":57,"cve_count":39,"kev_count":24,"last_cve_update":58},51573,"worldmap_panel",30,"2023-10-25",{"id":60,"product_name":61,"version_count":62,"cve_count":39,"kev_count":24,"last_cve_update":35},51562,"alloy",15,{"id":64,"product_name":65,"version_count":62,"cve_count":39,"kev_count":24,"last_cve_update":66},51564,"google_sheets","2023-10-16",{"id":68,"product_name":69,"version_count":70,"cve_count":39,"kev_count":24,"last_cve_update":71},51566,"grafana-image-renderer",29,"2022-09-02",{"id":73,"product_name":74,"version_count":75,"cve_count":24,"kev_count":24,"last_cve_update":76},51567,"json_api_data_source",48,null,"Grafana is a technology vendor with 13 tracked products and 91 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[79,87,95,102,108,114,121,126,132,138],{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":84,"severity":85,"isKev":4,"epssScore":86},"CVE-2021-39226","Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: \u002Fdashboard\u002Fsnapshot\u002F:key, or \u002Fapi\u002Fsnapshots\u002F:key. If the snapshot \"public_mode\" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: \u002Fapi\u002Fsnapshots-delete\u002F:deleteKey. Regardless of the snapshot \"public_mode\" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: \u002Fapi\u002Fsnapshots\u002F:key, or \u002Fapi\u002Fsnapshots-delete\u002F:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: \u002Fapi\u002Fsnapshots\u002F:key, \u002Fapi\u002Fsnapshots-delete\u002F:deleteKey, \u002Fdashboard\u002Fsnapshot\u002F:key, and \u002Fapi\u002Fsnapshots\u002F:key. They have no normal function and can be disabled without side effects.","2021-10-05",9.8,"v3.1","Critical",0.99933,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":84,"severity":92,"isKev":93,"epssScore":94},"CVE-2020-13379","The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user\u002Fclient to make Grafana send HTTP requests to any URL and return its result to the user\u002Fclient. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.","2020-06-03",8.2,"High",false,0.99856,{"cveId":96,"description":97,"publishedDate":98,"cvssScore":99,"cvssVersion":100,"severity":85,"isKev":93,"epssScore":101},"CVE-2024-9264","The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.","2024-10-18",9.4,"v4.0",0.97138,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":106,"cvssVersion":84,"severity":92,"isKev":93,"epssScore":107},"CVE-2025-4123","A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.","2025-05-22",7.6,0.97007,{"cveId":109,"description":110,"publishedDate":111,"cvssScore":112,"cvssVersion":84,"severity":92,"isKev":4,"epssScore":113},"CVE-2021-43798","Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `\u003Cgrafana_host_url>\u002Fpublic\u002Fplugins\u002F\u002F`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.","2021-12-07",7.5,0.88503,{"cveId":115,"description":116,"publishedDate":117,"cvssScore":118,"cvssVersion":84,"severity":119,"isKev":93,"epssScore":120},"CVE-2021-41174","Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.","2021-11-03",6.1,"Medium",0.85404,{"cveId":122,"description":123,"publishedDate":124,"cvssScore":112,"cvssVersion":84,"severity":92,"isKev":93,"epssScore":125},"CVE-2021-27358","The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","2021-03-18",0.83042,{"cveId":127,"description":128,"publishedDate":129,"cvssScore":130,"cvssVersion":84,"severity":92,"isKev":93,"epssScore":131},"CVE-2022-31097","Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.","2022-07-15",8.7,0.7006,{"cveId":133,"description":134,"publishedDate":135,"cvssScore":83,"cvssVersion":136,"severity":85,"isKev":93,"epssScore":137},"CVE-2018-15727","Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid \"remember me\" cookie knowing only a username of an LDAP or OAuth user.","2018-08-29","v3.0",0.64284,{"cveId":139,"description":140,"publishedDate":141,"cvssScore":112,"cvssVersion":136,"severity":92,"isKev":93,"epssScore":142},"CVE-2019-15043","In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.","2019-09-03",0.63388,[144,149],{"cveId":109,"description":110,"publishedDate":111,"cvssScore":112,"cvssVersion":84,"severity":92,"isKev":4,"epssScore":113,"cisaVulnName":145,"cisaDateAdded":146,"cisaShortDescription":147,"cisaRequiredAction":148},"Grafana Path Traversal Vulnerability","2025-10-09","Grafana contains a path traversal vulnerability that could allow access to local files.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":84,"severity":85,"isKev":4,"epssScore":86,"cisaVulnName":150,"cisaDateAdded":151,"cisaShortDescription":152,"cisaRequiredAction":153},"Grafana Authentication Bypass Vulnerability","2022-08-25","Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.","Apply updates per vendor instructions.",[155,156,157,158,159,160,161,162,163,164],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":11,"kev_count":24,"last_cve_update":25},{"id":27,"product_name":28,"version_count":29,"cve_count":11,"kev_count":24,"last_cve_update":30},{"id":32,"product_name":33,"version_count":34,"cve_count":11,"kev_count":24,"last_cve_update":35},{"id":37,"product_name":38,"version_count":29,"cve_count":39,"kev_count":24,"last_cve_update":40},{"id":42,"product_name":43,"version_count":44,"cve_count":39,"kev_count":24,"last_cve_update":45},{"id":47,"product_name":48,"version_count":24,"cve_count":39,"kev_count":24,"last_cve_update":49},{"id":51,"product_name":52,"version_count":24,"cve_count":39,"kev_count":24,"last_cve_update":53},{"id":55,"product_name":56,"version_count":57,"cve_count":39,"kev_count":24,"last_cve_update":58},{"id":60,"product_name":61,"version_count":62,"cve_count":39,"kev_count":24,"last_cve_update":35},{"title":166,"metaDescription":167,"keywords":168,"structuredData":169},"Grafana - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Grafana covering 13 products with 91 tracked vulnerabilities including 1 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Grafana vulnerabilities, Grafana security, Grafana CVE, Grafana threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Grafana KEV, Grafana exploited vulnerabilities",{"@context":170,"@type":171,"name":172,"description":167,"url":173},"https:\u002F\u002Fschema.org","Organization","Grafana","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fgrafana",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":175,"apiVersion":176},"2026-10-17T18:34:50.335Z","3.0"]