Vulnerabilidades en Grafana

110 resultados
Análisis Vexday

O ecossistema de vulnerabilidades do Grafana acumula 72 CVEs catalogadas, com 7 classificadas como críticas e 4 contando com prova de conceito pública disponível. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo KEV, o cenário exige atenção: a CVE-2024-9264 apresenta EPSS de 0,9778 — um dos índices de probabilidade de exploração mais elevados possíveis —, sinalizando risco iminente mesmo sem confirmação formal no KEV. O volume de 22 novas CVEs nos últimos 90 dias indica um ritmo de descoberta acelerado, e o predomínio de CWE-79 (Cross-site Scripting) como classe de falha mais frequente aponta para superfícies de ataque relacionadas à camada de apresentação e injeção de conteúdo nas interfaces da plataforma. Equipes responsáveis por ambientes Grafana devem priorizar a avaliação de CVE-2024-9264 e monitorar de perto o pipeline recente de correções.

CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2025-4123HIGHA cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attaEPSS 98.3%CVE-2024-9264CRITICALGrafana SQL Expressions allow for remote code executionEPSS 94.6%CVE-2021-43798HIGHGrafana path traversalEPSS 88.8%KEVCVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 84.6%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 68.6%CVE-2025-6197MEDIUMAn open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -EPSS 66.8%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 57.5%CVE-2025-6023HIGHAn open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introdEPSS 39.1%CVE-2025-2703MEDIUMThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in orEPSS 17.6%CVE-2025-41115CRITICALIncorrect privilege assignmentEPSS 16.9%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2023-0594HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability EPSS 9.2%CVE-2023-3128CRITICALGrafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modEPSS 4.0%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.8%CVE-2022-31107HIGHGrafana account takeover via OAuth vulnerabilityEPSS 2.5%CVE-2022-21702MEDIUMCross site scripting in Grafana proxyEPSS 2.3%CVE-2022-24812HIGHFGAC API Key privilege escalation in GrafanaEPSS 2.3%CVE-2022-21703MEDIUMCross Site Request Forgery in GrafanaEPSS 2.2%CVE-2022-21673MEDIUMOAuth Identity Token exposure in GrafanaEPSS 2.0%