Snapshot 250271
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Security Advisories Subscribe via RSS Showing 24 results, page 1 of 6 Published CVE records Published CVE Severity (CVSS) Product Advisory Title Updated 2026-10-27 CVE-2026-100105 High (7.7) Grafana Alerting contact point authorization bypass via schema downgrade — 2026-10-27 CVE-2026-88967 High (7.7) Grafana Azure Monitor access token disclosure via SSRF — 2026-10-27 CVE-2026-88858 Medium (6.5) Grafana Server-side expression parser denial of service — 2026-10-27 CVE-2026-103506 High (8.9) Grafana SSO settings authorization bypass — 2026-10-13 CVE-2026-93294 Medium (6.3) Grafana Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs — 2026-10-13 CVE-2026-92539 Medium (6.7) Grafana Enterprise Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise — 2026-10-13 CVE-2026-15577 Medium (6.5) Grafana Git Sync connection configuration can be modified with read-only access — 2026-10-13 CVE-2026-95502 Medium (5.3) Grafana Git Sync memory exhaustion via a malicious Git server — 2026-10-13 CVE-2026-33374 Medium (6.5) Grafana Unbounded memory allocation in the Prometheus rule conversion API — 2026-10-05 CVE-2026-89039 Medium (6.5) mcp-k6 Arbitrary file read via the convert_playwright_script prompt in mcp-k6 — 2026-09-29 CVE-2026-13719 Medium (4.3) Grafana Alert rules in restricted folders disclosed via the alert rules list API — 2026-09-29 CVE-2026-13720 Medium (5.4) Grafana Editor can forge file-provisioning provenance on dashboards via the dashboard API — 2026-09-29 CVE-2026-81842 Medium (4.3) Grafana Library panel can be moved into a folder without library panel create permission — 2026-09-29 CVE-2026-81841 Medium (5.3) Grafana Paused shared dashboard access tokens still expose data source configuration — 2026-09-15 CVE-2026-76154 High (7.3) Grafana Geomap MapLibre XSS — 2026-09-15 CVE-2026-15815 High (8.8) Grafana Grafana Plugin Extraction Zip Slip — 2026-09-02 CVE-2026-12704 Medium (6.8) Grafana Enterprise SAML assertion replay via skipped InResponseTo validation — 2026-09-02 CVE-2026-14199 High (7.1) Grafana Enterprise Session takeover via Auth Proxy cache key collision — 2026-09-02 CVE-2026-19475 Medium (6.5) PostgreSQL Datasource SQL Data Source Plugin: OOM DoS via $__timeGroup macro — 2026-08-27 CVE-2026-19854 Medium (6.1) Clickhouse Datasource clickhouse-datasource silently drops TLS over PDC — 2026-08-27 CVE-2026-75889 High (7.7) Alloy Grafana Alloy: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth — 2026-08-24 CVE-2026-17033 Medium (6.8) Grafana Grafana OSS: Stored XSS via external Alertmanager generatorURL — 2026-08-18 CVE-2026-17183 High (7.1) Grafana Grafana Alerting: Datasource query authorization bypass via spoofed queryType — 2026-08-11 CVE-2026-19516 Critical (9.1) Grafana MCP Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request) — Security Advisories | Grafana Labs