Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Client Tools 12 package grafana, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (80)
CVE-2024-9264 — CVSS 9.9 (critical): The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are…
CVE-2021-3711 — CVSS 9.8 (critical): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application…
CVE-2025-21613 — CVSS 9.8 (critical): go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git…
CVE-2021-3918 — CVSS 9.8 (critical): json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2023-3128 — CVSS 9.4 (critical): Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily…
CVE-2024-45337 — CVSS 9.1 (critical): Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be…
CVE-2021-41244 — CVSS 9.1 (critical): Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature…
CVE-2020-13379 — CVSS 8.2 (high): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated…
CVE-2021-43138 — CVSS 7.8 (high): In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js…
CVE-2025-6023 — CVSS 7.6 (high): An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was…
CVE-2022-36062 — CVSS 7.6 (high): Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to…
CVE-2021-36222 — CVSS 7.5 (high): ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2…
CVE-2022-41723 — CVSS 7.5 (high): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service…
CVE-2022-21698 — CVSS 7.5 (high): client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling…
CVE-2020-7753 — CVSS 7.5 (high): All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
CVE-2022-41715 — CVSS 7.5 (high): Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed…
CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
CVE-2022-27664 — CVSS 7.5 (high): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…
CVE-2022-32149 — CVSS 7.5 (high): An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to…
CVE-2023-2801 — CVSS 7.5 (high): Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources…
CVE-2023-45288 — CVSS 7.5 (high): An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames…
CVE-2025-47908 — CVSS 7.5 (high): Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a…
CVE-2023-40577 — CVSS 7.5 (high): Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST…
CVE-2019-15043 — CVSS 7.5 (high): In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service…
CVE-2021-28148 — CVSS 7.5 (high): One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is…
CVE-2022-23552 — CVSS 7.3 (high): Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and…
CVE-2022-31097 — CVSS 7.3 (high): Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and…
CVE-2023-0507 — CVSS 7.3 (high): Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability…
CVE-2023-0594 — CVSS 7.3 (high): Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability…
CVE-2024-45339 — CVSS 7.1 (high): When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file…
CVE-2021-27962 — CVSS 7.1 (high): Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a…
CVE-2022-31107 — CVSS 7.1 (high): Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible…
CVE-2021-41174 — CVSS 6.9 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to…
CVE-2022-39201 — CVSS 6.8 (medium): Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and…
CVE-2025-2703 — CVSS 6.8 (medium): The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in…
CVE-2022-39307 — CVSS 6.7 (medium): Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is…
CVE-2022-39324 — CVSS 6.7 (medium): Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a…
CVE-2022-29170 — CVSS 6.6 (medium): Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows…
CVE-2025-27144: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web…
CVE-2022-35957 — CVSS 6.6 (medium): Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation…
CVE-2018-19039 — CVSS 6.5 (medium): Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin…
CVE-2021-28146 — CVSS 6.5 (medium): The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an…
CVE-2021-28147 — CVSS 6.5 (medium): The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control…
CVE-2021-29622 — CVSS 6.5 (medium): Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To…
CVE-2022-0155 — CVSS 6.5 (medium): follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVE-2022-21702 — CVSS 6.5 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the…
CVE-2024-1313 — CVSS 6.5 (medium): It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing…
CVE-2025-22872 — CVSS 6.5 (medium): The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When…
CVE-2022-39306 — CVSS 6.4 (medium): Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to…
CVE-2022-21703 — CVSS 6.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery…
CVE-2023-1410 — CVSS 6.2 (medium): Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite…
CVE-2022-46146 — CVSS 6.2 (medium): Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a…
CVE-2022-31123 — CVSS 6.1 (medium): Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in…
CVE-2019-10215 — CVSS 6.1 (medium): Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could…
CVE-2024-22037 — CVSS 5.5 (medium): The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be…
CVE-2023-6152 — CVSS 5.4 (medium): A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration…
CVE-2025-11065 — CVSS 5.3 (medium): A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This…
CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
CVE-2024-8118: In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert…
CVE-2024-9476: A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other…
CVE-2025-3454 — CVSS 5.0 (medium): This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the…
CVE-2022-31130 — CVSS 4.9 (medium): Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could…
CVE-2025-22870 — CVSS 4.4 (medium): Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY…
CVE-2024-11741 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected…
CVE-2022-21673 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity…
CVE-2021-43815 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal…
CVE-2021-43813 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory…
CVE-2022-21713 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do…
CVE-2024-28180 — CVSS 4.3 (medium): Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a…
CVE-2022-39229 — CVSS 4.3 (medium): Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to…
CVE-2025-3415 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected…
CVE-2025-6197 — CVSS 4.2 (medium): An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -…
CVE-2023-1387 — CVSS 4.2 (medium): Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search…
CVE-2023-2183 — CVSS 4.1 (medium): Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel…
CVE-2025-29923 — CVSS 3.7 (low): go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially…
CVE-2024-51744 — CVSS 3.1 (low): golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to…