CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2025-3454 – openSUSE Security Advisory - openSUSE-SU-2025:15052-1
https://notcve.org/view.php?id=CVE-2025-3454
20 May 2025 — This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources. These are all security issues fixed in the grafana-11.5.4-1.1 package on the GA media of... • https://grafana.com/security/security-advisories/cve-2025-3454 • CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-11741
https://notcve.org/view.php?id=CVE-2024-11741
31 Jan 2025 — Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15 • https://grafana.com/security/security-advisories/cve-2024-11741 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10452
https://notcve.org/view.php?id=CVE-2024-10452
29 Oct 2024 — Organization admins can delete pending invites created in an organization they are not part of. • https://grafana.com/security/security-advisories/cve-2024-10452 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-8118 – Grafana alerting wrong permission on datasource rule write endpoint
https://notcve.org/view.php?id=CVE-2024-8118
26 Sep 2024 — In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. • https://grafana.com/security/security-advisories/cve-2024-8118 • CWE-653: Improper Isolation or Compartmentalization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-34111 – Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin
https://notcve.org/view.php?id=CVE-2023-34111
06 Jun 2023 — The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.title }}` in a bash command within the GitHub workflow. Attackers can inject malicious commands which will be executed by the workflow. This happens because `${{ github.event.pull_request.title }}` is directly passed to bash command on like 25 of the wor... • https://github.com/taosdata/grafanaplugin/blob/master/.github/workflows/release-pr-merged.yaml#L25 • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •