Grafana ≫ Grafana

94 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.

CVE-2026-21725

EPSS 0.03%
Veröffentlicht 25.02.2026 12:35:43
Zuletzt bearbeitet 27.02.2026 03:34:26

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to ...

5.3

CVE-2026-21722

EPSS 0.01%
Veröffentlicht 12.02.2026 09:16:08
Zuletzt bearbeitet 27.02.2026 15:16:27

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the...

6.1

CVE-2025-41117

EPSS 0.01%
Veröffentlicht 12.02.2026 09:16:07
Zuletzt bearbeitet 26.02.2026 22:20:42

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP A...

7.5

CVE-2026-21720

EPSS 0.02%
Veröffentlicht 27.01.2026 09:15:48
Zuletzt bearbeitet 17.02.2026 20:06:27

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks f...

7.6