Exposição de Grafana

Analytics
63
score de exposição
131
sites usam
2
em exploração
6
críticos
Análise Vexday

Com 57 CVEs catalogadas, o Grafana apresenta uma taxa de exploração ativa 7,8 vezes acima da média geral do catálogo CISA KEV, sinal de que vulnerabilidades nesta plataforma atraem atenção real de agentes maliciosos. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que sugere atenção contínua à sanitização de entradas e ao contexto de renderização de conteúdo. A CVE mais crítica em exploração ativa é a CVE-2021-39226, com índice EPSS de 0,9989 — próximo ao teto da escala —, indicando probabilidade extremamente elevada de tentativas de exploração em ambientes expostos. Embora não tenham surgido novas CVEs nos últimos 90 dias, a combinação de seis vulnerabilidades críticas catalogadas e dois registros confirmados no KEV justifica prioridade elevada em programas de patching e monitoramento ativo.

CVEs

57 resultados
CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2021-43798HIGHGrafana path traversalEPSS 88.8%KEVCVE-2025-4123HIGHA cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attaEPSS 98.3%CVE-2024-9264CRITICALGrafana SQL Expressions allow for remote code executionEPSS 94.6%CVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 84.6%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 68.6%CVE-2025-6197MEDIUMAn open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -EPSS 66.8%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 57.5%CVE-2025-6023HIGHAn open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introdEPSS 39.1%CVE-2025-2703MEDIUMThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in orEPSS 17.6%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2023-0594HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability EPSS 9.2%CVE-2023-3128CRITICALGrafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modEPSS 4.0%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.8%CVE-2022-31107HIGHGrafana account takeover via OAuth vulnerabilityEPSS 2.5%CVE-2022-21702MEDIUMCross site scripting in Grafana proxyEPSS 2.3%CVE-2022-24812HIGHFGAC API Key privilege escalation in GrafanaEPSS 2.3%CVE-2022-21703MEDIUMCross Site Request Forgery in GrafanaEPSS 2.2%CVE-2022-21673MEDIUMOAuth Identity Token exposure in GrafanaEPSS 2.0%CVE-2026-27876CRITICALRCE on Grafana via sqlExpressionsEPSS 1.9%