Grafana Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Grafana (7564912d-bb81-50cf-9eb9-f573ac2fa519) |
|---|---|
| Product | Grafana Oss (6c9e04ba-0f67-5305-b7cb-2348ed35da73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88967 |
vulnerable | 2026-11-03 10:17:49.067378 |
Azure Monitor access token disclosure via SSRF
HIGH (7.7)
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Published: 2026-10-28T16:49:57.393Z
Updated: 2026-11-05T17:25:12.131Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88858 |
vulnerable | 2026-11-03 10:17:48.894443 |
Server-side expression parser denial of service
MEDIUM (6.5)
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Published: 2026-10-28T16:50:17.291Z
Updated: 2026-11-05T17:19:10.148Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-79656 |
vulnerable | 2026-11-03 10:16:55.839800 |
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
MEDIUM (6)
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
Published: 2026-10-28T17:23:44.625Z
Updated: 2026-11-05T16:56:30.314Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33374 |
vulnerable | 2026-11-03 10:16:47.642188 |
Unbounded memory allocation in the Prometheus rule conversion API
MEDIUM (6.5)
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
Published: 2026-10-13T17:05:49.782Z
Updated: 2026-10-13T19:21:25.512Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93294 |
vulnerable | 2026-11-03 10:16:30.738225 |
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
MEDIUM (6.3)
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.
Published: 2026-10-13T17:05:49.715Z
Updated: 2026-10-13T19:31:30.245Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15577 |
vulnerable | 2026-11-03 10:16:19.562019 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9703 |
vulnerable | 2026-11-03 10:16:09.328615 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16491 |
vulnerable | 2026-11-03 10:15:59.957572 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-95502 |
vulnerable | 2026-11-03 10:15:49.735979 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-103506 |
vulnerable | 2026-11-03 10:15:49.274448 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-100105 |
vulnerable | 2026-11-03 10:15:33.391802 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15815 |
vulnerable | 2026-10-13 12:28:52.015310 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-76154 |
vulnerable | 2026-10-13 12:28:36.481729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11817 |
vulnerable | 2026-09-16 04:32:45.944713 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9029 |
vulnerable | 2026-07-29 01:09:06.596980 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8609 |
vulnerable | 2026-07-29 01:09:06.023785 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8595 |
vulnerable | 2026-07-29 01:09:06.009899 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42129 |
not_vulnerable | 2026-07-29 00:49:31.698953 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42127 |
vulnerable | 2026-07-29 00:49:31.698776 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33382 |
vulnerable | 2026-07-29 00:43:21.856506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28378 |
vulnerable | 2026-07-29 00:37:43.193834 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21723 |
vulnerable | 2026-07-29 00:29:08.146095 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10601 |
vulnerable | 2026-07-29 00:23:30.150738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33381 |
vulnerable | 2026-06-08 07:59:09.838995 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33380 |
vulnerable | 2026-06-08 07:59:09.838704 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33378 |
vulnerable | 2026-06-08 07:59:09.838305 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33377 |
vulnerable | 2026-06-08 07:59:09.837889 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33376 |
vulnerable | 2026-06-08 07:59:09.837442 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33375 |
vulnerable | 2026-06-08 07:59:09.835467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28383 |
vulnerable | 2026-06-08 07:55:15.230754 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28380 |
vulnerable | 2026-06-08 07:55:15.230409 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28379 |
vulnerable | 2026-06-08 07:55:15.230051 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28376 |
vulnerable | 2026-06-08 07:55:15.219830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28374 |
vulnerable | 2026-06-08 07:55:15.219054 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21724 |
vulnerable | 2026-06-08 07:49:16.728363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.