grafana (SUSE:Linux Enterprise Module for Package Hub 15 SP6) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Package Hub 15 SP6 package grafana, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (25)

• CVE-2024-9264 — CVSS 9.9 (critical): The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are…
• CVE-2025-21613 — CVSS 9.8 (critical): go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git…
• CVE-2023-3128 — CVSS 9.4 (critical): Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily…
• CVE-2024-45337 — CVSS 9.1 (critical): Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be…
• CVE-2025-64751 — CVSS 8.8 (high): OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA…
• CVE-2025-6023 — CVSS 7.6 (high): An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was…
• CVE-2023-45288 — CVSS 7.5 (high): An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames…
• CVE-2024-45339 — CVSS 7.1 (high): When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file…
• CVE-2025-2703 — CVSS 6.8 (medium): The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in…
• CVE-2025-27144: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web…
• CVE-2025-22872 — CVSS 6.5 (medium): The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When…
• CVE-2024-1313 — CVSS 6.5 (medium): It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing…
• CVE-2023-6152 — CVSS 5.4 (medium): A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration…
• CVE-2025-58190 — CVSS 5.3 (medium): The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of…
• CVE-2025-47911 — CVSS 5.3 (medium): The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial…
• CVE-2025-11065 — CVSS 5.3 (medium): A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This…
• CVE-2024-8118: In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert…
• CVE-2024-9476: A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other…
• CVE-2025-3454 — CVSS 5.0 (medium): This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the…
• CVE-2025-22870 — CVSS 4.4 (medium): Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY…
• CVE-2024-28180 — CVSS 4.3 (medium): Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a…
• CVE-2024-11741 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected…
• CVE-2025-3415 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected…
• CVE-2025-6197 — CVSS 4.2 (medium): An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -…
• CVE-2025-29923 — CVSS 3.7 (low): go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially…