Do Son Grafana patches a critical 9.1 RCE (CVE-2026-27876) in SQL expressions that allows SSH hijacking. Update to 12.4.2 now to secure your monitoring host.
Grafana
Grafana Enterprise released emergency patches for CVE-2025-41115 (CVSS 10.0), a critical flaw in SCIM provisioning that could allow attackers to impersonate high-privilege users.
GreyNoise observed a sudden, coordinated surge of 110 unique IPs exploiting the Grafana path traversal flaw (CVE-2021-43798), targeting only the US, Slovakia, and Taiwan.
Grafana Labs issued urgent patches for high-severity XSS (CVE-2025-6023) and medium-severity open redirect (CVE-2025-6197) vulnerabilities, impacting its observability platform.
Grafana warns of four critical RCE flaws in Image Renderer and Synthetic Monitoring Agent, stemming from Chromium V8 bugs. Update to patched versions immediately!
A medium-severity flaw (CVE-2025-3415) in Grafana Alerting exposes sensitive DingDing contact point URLs to viewers. Update to patch or disable the integration
Grafana rushed an emergency patch for CVE-2025-4123, a high-severity XSS flaw that was made public. Upgrade now to prevent unauthorized access.
Grafana fixes critical CVE-2025-3260 and two medium bugs, urging users to update immediately to prevent unauthorized access and XSS exploits.
Explore the technical details of CVE-2024-9264, a critical vulnerability in Grafana that allows attackers to exploit SQL expressions feature.
Grafana users, beware of CVE-2024-9264! Discover the details of this critical security vulnerability and find out how to safeguard your systems from potential attacks.
Critical security vulnerability in Grafana Plugin SDK for Go: CVE-2024-8986. Find out how this vulnerability could lead to the leakage of sensitive information and repository credentials.
CVE-2024-1313 exposes a vulnerability in Grafana, allowing any user, even those outside the snapshot owner's organization
The security vulnerability in Grafana, designated as CVE-2023-3128 and rated a highly critical 9.4 on the CVSS scale
An attacker could use the CVE-2022-31097 vulnerability to steal the victim's cookie-based authentication credentials.
Tracked as CVE-2022-31107, the flaw is an OAuth account takeover vulnerability with a CVSS severity score of 7.1.
Grafana issued a risk notice for Grafana Enterprise server-side request forgery vulnerability, the vulnerability number is CVE-2022-29170