Grafana Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Grafana (7564912d-bb81-50cf-9eb9-f573ac2fa519) |
|---|---|
| Product | Grafana Oss (6c9e04ba-0f67-5305-b7cb-2348ed35da73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9029 |
vulnerable | 2026-07-29 01:09:06.596980 |
Stored XSS in the Geomap panel tile-layer attribution
HIGH (7.3)
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
Published: 2026-06-22T13:18:40.770Z
Updated: 2026-07-29T13:59:57.387Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8609 |
vulnerable | 2026-07-29 01:09:06.023785 |
Pre-authentication denial of service via the OAuth login route
MEDIUM (5.3)
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Published: 2026-07-10T14:58:33.522Z
Updated: 2026-07-29T14:00:05.742Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8595 |
vulnerable | 2026-07-29 01:09:06.009899 |
Stored XSS in the table panel (TableNG)
MEDIUM (6.8)
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Published: 2026-07-10T14:59:35.891Z
Updated: 2026-07-29T13:59:56.196Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42129 |
not_vulnerable | 2026-07-29 00:49:31.698953 |
Path traversal in the Loki data source plugin
HIGH (7.7)
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
Published: 2026-06-22T13:18:27.365Z
Updated: 2026-07-29T13:59:55.045Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42127 |
vulnerable | 2026-07-29 00:49:31.698776 |
Pre-authentication denial of service in the public dashboard query endpoint
HIGH (7.5)
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.
Published: 2026-06-22T16:31:28.096Z
Updated: 2026-07-29T14:00:15.004Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33382 |
vulnerable | 2026-07-29 00:43:21.856506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28378 |
vulnerable | 2026-07-29 00:37:43.193834 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21723 |
vulnerable | 2026-07-29 00:29:08.146095 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10601 |
vulnerable | 2026-07-29 00:23:30.150738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33381 |
vulnerable | 2026-06-08 07:59:09.838995 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33380 |
vulnerable | 2026-06-08 07:59:09.838704 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33378 |
vulnerable | 2026-06-08 07:59:09.838305 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33377 |
vulnerable | 2026-06-08 07:59:09.837889 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33376 |
vulnerable | 2026-06-08 07:59:09.837442 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33375 |
vulnerable | 2026-06-08 07:59:09.835467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28383 |
vulnerable | 2026-06-08 07:55:15.230754 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28380 |
vulnerable | 2026-06-08 07:55:15.230409 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28379 |
vulnerable | 2026-06-08 07:55:15.230051 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28376 |
vulnerable | 2026-06-08 07:55:15.219830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28374 |
vulnerable | 2026-06-08 07:55:15.219054 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21724 |
vulnerable | 2026-06-08 07:49:16.728363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.