Read the docs

Grafana

Records175All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high67CVSS 7.0–8.9

Exploited now

Grafana records in CISA KEV
TI-2021-19604 Grafana Path Traversal Vulnerability Priority CRITICAL 90KEV 2025-10-09TI-2021-16611 Grafana Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2022-08-25

Components

Products in the NVD configurations · select one to filter the records
Grafana 104 records CRITICAL Tempo 3 records MEDIUM Agent 2 records LOW Enterprise Metrics 2 records LOW Loki 2 records LOW Piechart-panel 2 records LOW Alloy 1 record LOW Google Sheets 1 record LOW

Records

175 records

TI-2021-16611 CVE-2021-39226 · GHSA-69j6-29vr-p3j9

Snapshot authentication bypass in grafana

Priority CRITICAL 100KEV

Grafana is an open source data visualization platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99933 Published 2021-10-05 Partial fix · 8.1.6, 7.5.11 CWE-287
TI-2021-19604 CVE-2021-43798 · GHSA-8pjx-jj86-j47p

Grafana path traversal

Priority CRITICAL 90KEV

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.88503 Published 2021-12-07 Fixed in 8.0.7, 8.1.8 +2 CWE-22
TI-2024-08600 CVE-2024-9264 · GHSA-q99m-qcv4-fpm7

Grafana SQL Expressions allow for remote code execution

Priority CRITICAL 87

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.97553 Published 2024-10-18 Fixed in 11.0.5, 11.1.6 +7 CWE-94
TI-2023-02931 CVE-2023-3128 · GHSA-mpv3-g8m3-3fjc

Authentication bypass by spoofing in Grafana

Priority HIGH 82

Grafana is validating Azure AD accounts based on the email claim.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03995 Published 2023-06-22 Partial fix · 9.5.4, 9.4.13 +3 CWE-290
TI-2025-03662 CVE-2025-4123 · GHSA-q53q-gxq9-mgrj

Open redirect in Grafana

Priority HIGH 78

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.97083 Published 2025-05-22 Fixed in 10.4.19, 11.2.10 +6 CWE-601
TI-2022-13141 CVE-2022-31097 · GHSA-vw7q-p2qg-4m5f

Stored XSS in Grafana's Unified Alerting

Priority HIGH 77

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.7006 Published 2022-07-15 Partial fix · 9.0.3, 8.5.9 +2 CWE-79
TI-2022-13982 CVE-2022-32275 · GHSA-vq62-87gp-hrvv

Grafana 8.4.3 allows reading files via (for example) a…

Priority HIGH 72

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/..

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09514 Published 2022-06-06 Fix deferred CWE-22
TI-2025-05442 CVE-2025-6023 · GHSA-vqph-p5vc-g644

Open redirect in Grafana

Priority HIGH 67

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.57743 Published 2025-07-18 Fixed in 12.0.2+security-01, 11.6.3+security-01 +4 CWE-601
TI-2025-27465 CVE-2025-41115 · GHSA-w62r-7c53-fmc5

Incorrect privilege assignment in Grafana Enterprise

Priority HIGH 66

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.17498 Published 2025-11-21 Fixed in 12.2.1, 12.0.7 +3 CWE-266
TI-2023-01311 CVE-2023-1387 · GHSA-c3h9-vpfv-3x4m

Information disclosure in Grafana

Priority HIGH 66

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01504 Published 2023-04-26 Partial fix · 9.2.17, 9.3.13 +1 CWE-200
TI-2023-02048 CVE-2023-2183 · GHSA-cvm3-pp2j-chr3

Improper access control in Grafana

Priority MEDIUM 62

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.01027 Published 2023-06-06 Partial fix · 8.5.26, 9.2.19 +3 CWE-284
TI-2022-06078 CVE-2022-21702 · GHSA-xc3p-28hw-q24g

Cross site scripting in Grafana proxy

Priority MEDIUM 62

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0234 Published 2022-02-08 Partial fix · 7.5.15, 8.3.5 CWE-79
TI-2023-01334 CVE-2023-1410 · GHSA-qrrg-gw7w-vp76

Stored XSS in Graphite FunctionDescription tooltip

Priority MEDIUM 61

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.2 Network High privileges User interaction EPSS 0.00954 Published 2023-03-23 Partial fix · 8.5.22, 9.2.15 +2 CWE-79
TI-2023-05657 CVE-2023-6152 · GHSA-3hv4-r2fm-h27f

Incorrect authorization in Grafana

Priority MEDIUM 58

A user changing their email after signing up and verifying it can change it without verification in profile settings.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01385 Published 2024-02-13 Partial fix · 9.5.16, 10.0.11 +3 CWE-863
TI-2025-05605 CVE-2025-6197 · GHSA-jvcj-qc86-j594

Open redirect in Grafana

Priority MEDIUM 57

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.70143 Published 2025-07-18 Partial fix · 12.0.2+security-01, 11.6.3+security-01 +3 CWE-601
TI-2021-19619 CVE-2021-43813

Directory Traversal in Grafana

Priority MEDIUM 53

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.56588 Published 2021-12-10 Partial fix · 7.5.12, 8.3.2 CWE-22
TI-2023-00481 CVE-2023-0507 · GHSA-hjv9-hm2f-rpcj

Cross-site scripting in Grafana

Priority MEDIUM 50

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.1546 Published 2023-03-01 Partial fix · 8.5.21, 9.2.13 +1 CWE-79
Load more
Open these records in search →