CVE Database and Vulnerability Search

Vulnerabilities: 381,276
with PoCs: 37,250
CISA KEV: 1,665
Ransomware: 606
with Nuclei: 4,342

Vulnerability search results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-28378LOW	Cross-Organization Public Dashboard Deletion via Missing Org Isolation The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers. CWE-284Jul 7, 2026	CVSS3.1v3.1	EPSS0.136%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-42127HIGH	Pre-authentication denial of service in the public dashboard query endpoint The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability. CWE-400 CWE-770Jun 22, 2026	CVSS7.5v3.1	EPSS0.432%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-41115CRITICAL	Incorrect privilege assignment SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privil… CWE-266Nov 21, 2025	CVSS10.0v3.1	EPSS16.9%	PoCs2	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3454MEDIUM	Grafana's datasource proxy API allows authorization checks to be bypassed This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources. CWE-285Jun 2, 2025	CVSS5.0v3.1	EPSS0.414%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-2703MEDIUM	The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript. CWE-79Apr 23, 2025	CVSS6.8v3.1	EPSS18.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6322	Grafana plugin data sources vulnerable to access control bypass Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource. CWE-266Aug 20, 2024	CVSS-v4.0	EPSS0.305%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-6152MEDIUM	Email Validation Bypass And Preventing Sign Up From Email's Owner A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. CWE-863Feb 13, 2024	CVSS5.4v3.1	EPSS1.39%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-4399MEDIUM	Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address. CWE-183Oct 17, 2023	CVSS6.6v3.1	EPSS1.08%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-4822MEDIUM	Grafana privilege escalation vulnerability Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin … CWE-269Oct 16, 2023	CVSS6.7v3.1	EPSS1.07%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-3128CRITICAL	Grafana vulnerable to Authentication Bypass by Spoofing Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. CWE-290Jun 22, 2023	CVSS9.4v3.1	EPSS4%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-2183MEDIUM	Grafana has Broken Access Control in Alert manager: Viewer can send test alerts Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Use… CWE-284 CWE-862Jun 6, 2023	CVSS4.1v3.1	EPSS1.03%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-2801HIGH	Grafana Missing Synchronization vulnerability Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4… CWE-662 CWE-820Jun 6, 2023	CVSS7.5v3.1	EPSS0.745%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-1387MEDIUM	Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. CWE-200Apr 26, 2023	CVSS4.2v3.1	EPSS1.5%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-1410MEDIUM	Stored XSS in Graphite FunctionDescription tooltip Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hov… CWE-79Mar 23, 2023	CVSS6.2v3.1	EPSS0.962%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-0594HIGH	Grafana vulnerable to Cross-site Scripting Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This… CWE-79Mar 1, 2023	CVSS7.3v3.1	EPSS9.22%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-0507HIGH	Grafana vulnerable to Cross-site Scripting Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing… CWE-79Mar 1, 2023	CVSS7.3v3.1	EPSS15.5%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX