{"package":"github.com/grafana/grafana","ecosystem":"go","latest_version":"v5.4.5+incompatible","description":"The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more. ","license":"Apache-2.0","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://pkg.go.dev/github.com/grafana/grafana","repository":"https://github.com/grafana/grafana","downloads_weekly":76846,"health":{"score":40,"risk":"high","breakdown":{"maintenance":20,"popularity":10,"security":0,"maturity":15,"community":10},"deprecated":false,"max_score":100},"vulnerabilities":{"count":81,"critical":2,"high":13,"medium":26,"low":40,"details":[{"vuln_id":"BIT-grafana-2023-6152","severity":"medium","summary":"Email Validation Bypass And Preventing Sign Up From Email's Owner","affected_versions":">=2.5.0,<9.5.16|>=10.0.0,<10.0.11|>=10.1.0,<10.1.7|>=10.2.0,<10.2.4|>=10.3.0,<10.3.3","fixed_version":"10.3.3","source":"osv","published_at":"2024-02-13T22:25:10Z"},{"vuln_id":"BIT-grafana-2020-12458","severity":"high","summary":"Grafana information disclosure","affected_versions":"<7.2.1","fixed_version":"7.2.1","source":"osv","published_at":"2022-05-24T17:16:53Z"},{"vuln_id":"BIT-grafana-2022-39307","severity":"high","summary":"Grafana User enumeration via forget password","affected_versions":">=9.0.0,<9.2.4|<8.5.15","fixed_version":"8.5.15","source":"osv","published_at":"2024-05-14T22:29:31Z"},{"vuln_id":"BIT-grafana-2025-3260","severity":"high","summary":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions","affected_versions":">=0.0.0-20250114093457-36d6fad421fb,<0.0.0-20250521183405-c7a690348df7","fixed_version":"0.0.0-20250521183405-c7a690348df7","source":"osv","published_at":"2025-06-02T12:30:33Z"},{"vuln_id":"BIT-grafana-2026-27877","severity":"medium","summary":"Grafana public dashboards disclose all direct mode datasources","affected_versions":">=9.3.0|>=12.0.0|>=12.2.0|>=12.3.0|>=12.4.0|>=1.9.2-0.20221116104934-4ee83a5f2bf4,<1.9.2-0.20260325055210-3522153e07b4","fixed_version":"1.9.2-0.20260325055210-3522153e07b4","source":"osv","published_at":"2026-03-27T15:30:25Z"},{"vuln_id":"BIT-grafana-2026-42127","severity":"high","summary":"Grafana: Pre-authentication denial of service in the public dashboard query handler","affected_versions":">=2.0.0-beta1|>=12.0.0|>=12.3.0|>=12.4.0|>=13.0.0|<1.9.2-0.20260616075434-82ef13993059","fixed_version":"1.9.2-0.20260616075434-82ef13993059","source":"osv","published_at":"2026-06-22T18:34:17Z"},{"vuln_id":"BIT-grafana-2025-3415","severity":"medium","summary":"Grafana's insecure DingDing Alert integration exposes sensitive information","affected_versions":"<1.9.2-0.20250514160932-04111e9f2afd","fixed_version":"1.9.2-0.20250514160932-04111e9f2afd","source":"osv","published_at":"2025-07-17T12:30:37Z"},{"vuln_id":"BIT-grafana-2022-39324","severity":"medium","summary":"Grafana Spoofing originalUrl of snapshots","affected_versions":">=9.0.0,<9.2.8|<8.5.16","fixed_version":"8.5.16","source":"osv","published_at":"2024-05-14T22:29:26Z"},{"vuln_id":"CVE-2019-19499","severity":"medium","summary":"Grafana Arbitrary File Read","affected_versions":"<6.4.4","fixed_version":"6.4.4","source":"osv","published_at":"2024-01-31T23:11:17Z"},{"vuln_id":"BIT-grafana-2022-21713","severity":"medium","summary":"Grafana API IDOR","affected_versions":">=5.0.0-beta1,<7.5.15|>=8.0.0,<8.3.5","fixed_version":"8.3.5","source":"osv","published_at":"2024-05-14T22:17:22Z"},{"vuln_id":"BIT-grafana-2024-10452","severity":"low","summary":"Grafana org admin can delete pending invites in different org","affected_versions":"<=10.4.0","fixed_version":null,"source":"osv","published_at":"2024-10-29T18:30:36Z"},{"vuln_id":"BIT-grafana-2021-39226","severity":"high","summary":"Authentication bypass for viewing and deletions of snapshots","affected_versions":"<7.5.11|>=8.0.0,<8.1.6","fixed_version":"8.1.6","source":"osv","published_at":"2021-10-05T20:24:02Z"},{"vuln_id":"CVE-2018-18625","severity":"medium","summary":"Grafana XSS via adding a link in General feature","affected_versions":"<6.0.0-beta1","fixed_version":"6.0.0-beta1","source":"osv","published_at":"2024-01-30T23:47:50Z"},{"vuln_id":"BIT-grafana-2026-21724","severity":"medium","summary":"Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions","affected_versions":"<1.9.2-0.20260323180334-daffe750de85","fixed_version":"1.9.2-0.20260323180334-daffe750de85","source":"osv","published_at":"2026-03-26T21:31:27Z"},{"vuln_id":"BIT-grafana-2020-13430","severity":"medium","summary":"Grafana XSS via the OpenTSDB datasource","affected_versions":"<7.0.0","fixed_version":"7.0.0","source":"osv","published_at":"2022-05-24T17:18:38Z"},{"vuln_id":"CVE-2019-13068","severity":"medium","summary":"Grafana Cross-site Scripting vulnerability","affected_versions":"<6.2.5","fixed_version":"6.2.5","source":"osv","published_at":"2022-05-24T16:49:05Z"},{"vuln_id":"BIT-grafana-2026-10601","severity":"medium","summary":"Grafana: Path traversal in the Tempo and Loki data source plugins","affected_versions":">=2.0.0-beta1|>=12.0.0|>=12.3.0|>=13.0.0|>=12.4.0|<1.9.2-0.20260616075434-82ef13993059","fixed_version":"1.9.2-0.20260616075434-82ef13993059","source":"osv","published_at":"2026-06-22T15:30:43Z"},{"vuln_id":"BIT-grafana-2026-9029","severity":"high","summary":"Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug","affected_versions":">=2.0.0-beta1|>=13.0.0|<1.9.2-0.20260616075434-82ef13993059","fixed_version":"1.9.2-0.20260616075434-82ef13993059","source":"osv","published_at":"2026-06-22T15:30:46Z"},{"vuln_id":"CVE-2018-18624","severity":"medium","summary":"Grafana XSS via a column style","affected_versions":"<7.0.0","fixed_version":"7.0.0","source":"osv","published_at":"2022-05-24T17:18:56Z"},{"vuln_id":"BIT-grafana-2025-3454","severity":"medium","summary":"Grafana's datasource proxy API allows authorization checks to be bypassed","affected_versions":">=0.0.0-20210414170620-dadccdda06e6,<0.0.0-20250424191517-1f707d16ed5d","fixed_version":"0.0.0-20250424191517-1f707d16ed5d","source":"osv","published_at":"2025-06-02T12:30:33Z"},{"vuln_id":"BIT-grafana-2020-12245","severity":"medium","summary":"Grafana XSS in header column rename","affected_versions":"<6.7.3","fixed_version":"6.7.3","source":"osv","published_at":"2022-05-24T17:16:26Z"},{"vuln_id":"CVE-2018-18623","severity":"medium","summary":"Grafana XSS in Dashboard Text Panel","affected_versions":"<6.0.0-beta1","fixed_version":"6.0.0-beta1","source":"osv","published_at":"2024-01-30T23:47:48Z"},{"vuln_id":"BIT-grafana-2025-1088","severity":"low","summary":"Grafana long dashboard title or panel name causes unresponsives","affected_versions":">=0.0.1-test,<11.6.2|<0.0.0-20250521211231-e0ba4b480954","fixed_version":"0.0.0-20250521211231-e0ba4b480954","source":"osv","published_at":"2025-06-18T12:30:30Z"},{"vuln_id":"BIT-grafana-2023-2183","severity":"medium","summary":"Grafana has Broken Access Control in Alert manager: Viewer can send test alerts","affected_versions":"<8.5.26|>=9.0.0,<9.2.19|>=9.3.0,<9.3.15|>=9.4.0,<9.4.12|>=9.5.0,<9.5.3","fixed_version":"9.5.3","source":"osv","published_at":"2023-06-12T20:09:27Z"},{"vuln_id":"CVE-2026-42129","severity":"high","summary":"Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.","affected_versions":">=2.0.0-beta1|>=12.0.0|>=12.3.0|>=13.0.0|>=12.4.0|<1.9.2-0.20260616075434-82ef13993059","fixed_version":"1.9.2-0.20260616075434-82ef13993059","source":"osv","published_at":"2026-06-22T15:30:43Z"},{"vuln_id":"BIT-grafana-2022-35957","severity":"high","summary":"Grafana Escalation from admin to server admin when auth proxy is used","affected_versions":">=9.1.0,<9.1.6|>=9.0.0,<9.0.9|<8.5.13","fixed_version":"8.5.13","source":"osv","published_at":"2024-05-14T22:25:56Z"},{"vuln_id":"BIT-grafana-2023-4822","severity":"medium","summary":"Grafana privilege escalation vulnerability","affected_versions":"<=10.1.5","fixed_version":null,"source":"osv","published_at":"2023-10-16T09:30:19Z"},{"vuln_id":"BIT-grafana-2022-39229","severity":"medium","summary":"Grafana when using email as a username can block other users from signing in","affected_versions":"<8.5.14|>=9.0.0,<9.1.8","fixed_version":"9.1.8","source":"osv","published_at":"2024-05-14T22:29:38Z"},{"vuln_id":"BIT-grafana-2026-33380","severity":"medium","summary":"Grafana: SQL Expressions Read File From Disk","affected_versions":"<1.9.2-0.20260513165311-fb7336fc36c1","fixed_version":"1.9.2-0.20260513165311-fb7336fc36c1","source":"osv","published_at":"2026-05-13T21:32:06Z"},{"vuln_id":"BIT-grafana-2024-6322","severity":"medium","summary":"Grafana plugin data sources vulnerable to access control bypass","affected_versions":">=11.1.0,<11.1.1|>=11.1.2,<11.1.3|>=0.0.0-20240521130516-0072e4a92d89,<0.0.0-20240725142242-c326d865c58b|>=1.9.2-0.20240521130516-0072e4a92d89,<1.9.2-0.20240725142242-c326d865c58b|=11.1.0|=11.1.2","fixed_version":"1.9.2-0.20240725142242-c326d865c58b","source":"osv","published_at":"2024-08-20T18:31:26Z"},{"vuln_id":"BIT-grafana-2023-3128","severity":"critical","summary":"Grafana vulnerable to Authentication Bypass by Spoofing","affected_versions":">=9.4.0,<9.4.13|>=9.3.0,<9.3.16|>=9.0.0,<9.2.20|<8.5.27","fixed_version":"8.5.27","source":"osv","published_at":"2023-06-22T21:30:49Z"},{"vuln_id":"BIT-grafana-2020-24303","severity":"medium","summary":"Grafana XSS via a query alias for the ElasticSearch datasource","affected_versions":"<7.1.0-beta1","fixed_version":"7.1.0-beta1","source":"osv","published_at":"2022-05-24T17:32:32Z"},{"vuln_id":"BIT-grafana-2022-31107","severity":"high","summary":"Grafana account takeover via OAuth vulnerability","affected_versions":">=5.3.0-beta1,<8.3.10|>=8.4.0,<8.4.10|>=8.5.0,<8.5.9|>=9.0.0,<9.0.3","fixed_version":"9.0.3","source":"osv","published_at":"2024-05-14T22:22:35Z"},{"vuln_id":"BIT-grafana-2025-4123","severity":"high","summary":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin","affected_versions":"<0.0.0-20250521183405-c7a690348df7","fixed_version":"0.0.0-20250521183405-c7a690348df7","source":"osv","published_at":"2025-05-22T09:33:21Z"},{"vuln_id":"BIT-grafana-2025-6023","severity":"high","summary":"Grafana is vulnerable to XSS attacks through open redirects and path traversal","affected_versions":"<1.9.2-0.20250521205822-0ba0b99665a9","fixed_version":"1.9.2-0.20250521205822-0ba0b99665a9","source":"osv","published_at":"2025-07-18T09:30:31Z"},{"vuln_id":"BIT-grafana-2025-41115","severity":"critical","summary":"Grafana Incorrect Privilege Assignment vulnerability","affected_versions":">=12.0.0,<12.0.7|>=12.1.0,<12.1.4|>=12.2.0,<12.2.2|>=1.9.2-0.20250310110405-e6fdb746f235,<1.9.2-0.20251106142618-ca5d89812015","fixed_version":"1.9.2-0.20251106142618-ca5d89812015","source":"osv","published_at":"2025-11-21T15:31:28Z"},{"vuln_id":"BIT-grafana-2020-13379","severity":"medium","summary":"Server Side Request Forgery in Grafana","affected_versions":">=3.0.1,<6.7.4|>=7.0.0,<7.0.2","fixed_version":"7.0.2","source":"osv","published_at":"2022-02-15T01:57:18Z"},{"vuln_id":"BIT-grafana-2026-33381","severity":"medium","summary":"Grafana: Users can generate Service Account tokens after permissions removal","affected_versions":"<1.9.2-0.20260513165311-fb7336fc36c1","fixed_version":"1.9.2-0.20260513165311-fb7336fc36c1","source":"osv","published_at":"2026-05-13T21:32:06Z"},{"vuln_id":"BIT-grafana-2024-11741","severity":"medium","summary":"Grafana Alerting VictorOps integration could be exposed to users with Viewer permission","affected_versions":">=11.4.0,<11.4.1|>=11.3.0,<11.3.3|>=11.2.0,<11.2.6|>=11.1.0,<11.1.11|>=11.0.0,<11.0.11|>=1.9.2,<10.4.15|<0.0.0-20250129224826-70073427041e|>=0.0.0,<1.9.2-0.20250129224826-70073427041e|=11.4.0","fixed_version":"1.9.2-0.20250129224826-70073427041e","source":"osv","published_at":"2025-01-31T18:31:07Z"},{"vuln_id":"BIT-grafana-2023-2801","severity":"high","summary":"Grafana Missing Synchronization vulnerability","affected_versions":"<9.4.12|>=9.5.0,<9.5.3","fixed_version":"9.5.3","source":"osv","published_at":"2023-06-06T21:30:18Z"},{"vuln_id":"BIT-grafana-2022-39201","severity":"high","summary":"Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins","affected_versions":">=5.0.0-beta1,<8.5.14|>=9.0.0,<9.1.8","fixed_version":"9.1.8","source":"osv","published_at":"2024-05-14T22:29:41Z"},{"vuln_id":"BIT-grafana-2022-21702","severity":"medium","summary":"Grafana proxy Cross-site Scripting","affected_versions":">=2.0.0-beta1,<7.5.15|>=8.0.0,<8.3.5","fixed_version":"8.3.5","source":"osv","published_at":"2024-05-14T22:15:09Z"},{"vuln_id":"BIT-grafana-2020-11110","severity":"medium","summary":"Grafana stored XSS","affected_versions":"<6.7.2","fixed_version":"6.7.2","source":"osv","published_at":"2022-05-24T17:24:21Z"},{"vuln_id":"CVE-2018-18623","severity":"unknown","summary":"Grafana XSS in Dashboard Text Panel in github.com/grafana/grafana","affected_versions":"<6.0.0-beta1+incompatible","fixed_version":"6.0.0-beta1+incompatible","source":"osv","published_at":"2024-08-21T14:30:29Z"},{"vuln_id":"CVE-2018-18625","severity":"unknown","summary":"Grafana XSS via adding a link in General feature in github.com/grafana/grafana","affected_versions":"<6.0.0-beta1+incompatible","fixed_version":"6.0.0-beta1+incompatible","source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2020-12458","severity":"unknown","summary":"Grafana information disclosure in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2020-13430","severity":"unknown","summary":"Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2020-12245","severity":"unknown","summary":"Grafana XSS in header column rename in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2020-12459","severity":"unknown","summary":"Grafana world readable configuration files in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-07-02T19:23:51Z"},{"vuln_id":"BIT-grafana-2020-24303","severity":"unknown","summary":"Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2020-11110","severity":"unknown","summary":"Grafana stored XSS in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-28T15:28:53Z"},{"vuln_id":"BIT-grafana-2024-1442","severity":"unknown","summary":"Grafana's users with permissions to create a data source can CRUD all data sources in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:52Z"},{"vuln_id":"BIT-grafana-2024-1313","severity":"unknown","summary":"Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:52Z"},{"vuln_id":"BIT-grafana-2022-39306","severity":"unknown","summary":"Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-39307","severity":"unknown","summary":"Grafana User enumeration via forget password in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-35957","severity":"unknown","summary":"Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-39229","severity":"unknown","summary":"Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-31130","severity":"unknown","summary":"Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-31107","severity":"unknown","summary":"Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-36062","severity":"unknown","summary":"Grafana folders admin only permission privilege escalation in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-31123","severity":"unknown","summary":"Grafana Plugin signature bypass in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-39328","severity":"unknown","summary":"Grafana Race condition allowing privilege escalation in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-31097","severity":"unknown","summary":"Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2022-39201","severity":"unknown","summary":"Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana","affected_versions":">=5.0.0-beta1+incompatible","fixed_version":null,"source":"osv","published_at":"2024-06-10T16:39:03Z"},{"vuln_id":"BIT-grafana-2022-39324","severity":"unknown","summary":"Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-06-05T15:10:42Z"},{"vuln_id":"BIT-grafana-2024-6322","severity":"unknown","summary":"Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-08-22T20:03:04Z"},{"vuln_id":"BIT-grafana-2024-9264","severity":"unknown","summary":"Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-10-28T15:20:02Z"},{"vuln_id":"BIT-grafana-2024-10452","severity":"unknown","summary":"Grafana org admin can delete pending invites in different org in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2024-11-04T15:44:16Z"},{"vuln_id":"BIT-grafana-2024-11741","severity":"unknown","summary":"Grafana Alerting VictorOps integration could be exposed to users with Viewer permission in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2025-02-04T22:06:11Z"},{"vuln_id":"BIT-grafana-2025-4123","severity":"unknown","summary":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2025-05-27T20:47:04Z"},{"vuln_id":"BIT-grafana-2025-3260","severity":"unknown","summary":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana","affected_versions":">=0.0.0-20250114093457-36d6fad421fb","fixed_version":null,"source":"osv","published_at":"2025-06-09T18:14:36Z"},{"vuln_id":"BIT-grafana-2025-3454","severity":"unknown","summary":"Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana","affected_versions":">=0.0.0-20210414170620-dadccdda06e6","fixed_version":null,"source":"osv","published_at":"2025-06-09T18:14:36Z"},{"vuln_id":"BIT-grafana-2025-1088","severity":"unknown","summary":"Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana","affected_versions":">=0.0.1-test,<0.0.0-20250521211231-e0ba4b480954","fixed_version":"0.0.0-20250521211231-e0ba4b480954","source":"osv","published_at":"2025-07-28T19:57:13Z"},{"vuln_id":"BIT-grafana-2025-3415","severity":"unknown","summary":"Grafana's insecure DingDing Alert integration exposes sensitive information in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2025-07-29T18:49:33Z"},{"vuln_id":"BIT-grafana-2025-6023","severity":"unknown","summary":"Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2025-07-29T18:49:33Z"},{"vuln_id":"BIT-grafana-2025-41115","severity":"unknown","summary":"Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana","affected_versions":">=1.9.2-0.20250310110405-e6fdb746f235","fixed_version":null,"source":"osv","published_at":"2025-11-25T18:12:18Z"},{"vuln_id":"BIT-grafana-2026-27877","severity":"unknown","summary":"Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2026-06-25T18:26:48Z"},{"vuln_id":"BIT-grafana-2026-21724","severity":"unknown","summary":"Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2026-06-25T18:43:15Z"},{"vuln_id":"BIT-grafana-2025-41117","severity":"unknown","summary":"Grafana has a Cross-site Scripting issue in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2026-06-25T18:43:19Z"},{"vuln_id":"BIT-grafana-2026-33380","severity":"unknown","summary":"Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2026-06-25T22:34:31Z"},{"vuln_id":"BIT-grafana-2026-33381","severity":"unknown","summary":"Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana","affected_versions":null,"fixed_version":null,"source":"osv","published_at":"2026-06-25T22:34:38Z"}]},"versions":{"latest":"v5.4.5+incompatible","total_count":140,"recent":["v3.0.3+incompatible","v3.1.1+incompatible","v5.2.5+incompatible","v6.1.6+incompatible","v1.8.1","v5.0.2+incompatible","v5.3.3+incompatible","v0.0.0-testrgm4","v1.0.1","v1.1.0","v4.4.3+incompatible","v5.0.0-beta5+incompatible","v4.5.0-beta1+incompatible","v4.5.1+incompatible","v4.4.0+incompatible","v4.0.1+incompatible","v6.0.0+incompatible","v5.1.0+incompatible","v5.4.5+incompatible","v5.0.0-beta3+incompatible"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":0,"first_published":null,"last_published":"2019-08-19T14:38:14Z","dependencies_count":0,"dependencies":[]},"github_stats":{"stars":76181,"forks":14532,"open_issues":3397,"is_archived":false,"pushed_at":"2026-08-09T17:46:03+00:00"},"bundle":null,"typescript":null,"known_issues":{"bugs_count":61,"bugs_severity":{"high":5,"medium":54,"low":1,"critical":1},"status_breakdown":{"fixed":26,"open":35},"link":"/api/bugs/go/github.com/grafana/grafana?version=v5.4.5+incompatible","scope":"version","details":[{"title":"Grafana Missing Synchronization vulnerability","severity":"high","status":"fixed","affected_version":null,"fixed_version":"9.4.12","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2801"},{"title":"Grafana is vulnerable to XSS attacks through open redirects and path traversal","severity":"high","status":"fixed","affected_version":null,"fixed_version":"1.9.2-0.20250521205822-0ba0b99665a9","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6023"},{"title":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin","severity":"high","status":"fixed","affected_version":null,"fixed_version":"0.0.0-20250521183405-c7a690348df7","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4123"},{"title":"Authentication bypass for viewing and deletions of snapshots","severity":"high","status":"fixed","affected_version":null,"fixed_version":"7.5.11","url":"https://github.com/grafana/grafana/security/advisories/GHSA-69j6-29vr-p3j9"},{"title":"Grafana information disclosure","severity":"high","status":"fixed","affected_version":null,"fixed_version":"7.2.1","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12458"}]},"historical_compromise":null,"recommendation":{"action":"do_not_use","issues":["Moderate health score (40/100) — verify manually","13 high severity vulnerabilities","2 critical vulnerabilities"],"use_version":"v5.4.5+incompatible","version_hint":"Update to >= 0.0.0-20250521211231-e0ba4b480954 to fix known vulnerabilities","summary":"github.com/grafana/grafana has critical vulnerabilities — do not use"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/go/github.com%2Fgrafana%2Fgrafana","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/go/github.com%2Fgrafana%2Fgrafana","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/go/github.com%2Fgrafana%2Fgrafana","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate"},"_cache":"hit","_response_ms":0}