Approved changes feed: RSS · Atom

cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGrafana (7564912d-bb81-50cf-9eb9-f573ac2fa519)
ProductGrafana Oss (6c9e04ba-0f67-5305-b7cb-2348ed35da73)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-9029 vulnerable 2026-07-29 01:09:06.596980 Stored XSS in the Geomap panel tile-layer attribution
HIGH (7.3)
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
Published: 2026-06-22T13:18:40.770Z
Updated: 2026-07-29T13:59:57.387Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8609 vulnerable 2026-07-29 01:09:06.023785 Pre-authentication denial of service via the OAuth login route
MEDIUM (5.3)
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Published: 2026-07-10T14:58:33.522Z
Updated: 2026-07-29T14:00:05.742Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8595 vulnerable 2026-07-29 01:09:06.009899 Stored XSS in the table panel (TableNG)
MEDIUM (6.8)
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Published: 2026-07-10T14:59:35.891Z
Updated: 2026-07-29T13:59:56.196Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-42129 not_vulnerable 2026-07-29 00:49:31.698953 Path traversal in the Loki data source plugin
HIGH (7.7)
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Published: 2026-06-22T13:18:27.365Z
Updated: 2026-07-29T13:59:55.045Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-42127 vulnerable 2026-07-29 00:49:31.698776 Pre-authentication denial of service in the public dashboard query endpoint
HIGH (7.5)
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Published: 2026-06-22T16:31:28.096Z
Updated: 2026-07-29T14:00:15.004Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33382 vulnerable 2026-07-29 00:43:21.856506 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28378 vulnerable 2026-07-29 00:37:43.193834 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21723 vulnerable 2026-07-29 00:29:08.146095 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-10601 vulnerable 2026-07-29 00:23:30.150738 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33381 vulnerable 2026-06-08 07:59:09.838995 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33380 vulnerable 2026-06-08 07:59:09.838704 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33378 vulnerable 2026-06-08 07:59:09.838305 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33377 vulnerable 2026-06-08 07:59:09.837889 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33376 vulnerable 2026-06-08 07:59:09.837442 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-33375 vulnerable 2026-06-08 07:59:09.835467 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28383 vulnerable 2026-06-08 07:55:15.230754 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28380 vulnerable 2026-06-08 07:55:15.230409 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28379 vulnerable 2026-06-08 07:55:15.230051 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28376 vulnerable 2026-06-08 07:55:15.219830 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28374 vulnerable 2026-06-08 07:55:15.219054 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-21724 vulnerable 2026-06-08 07:49:16.728363 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.