| CVE-2025-41117 |
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
|
6.8
Medium
|
Feb 12, 2026 |
| CVE-2026-21722 |
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
|
5.3
Medium
|
Feb 12, 2026 |
| CVE-2026-21721 |
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
|
8.1
High
|
Jan 27, 2026 |
| CVE-2026-21720 |
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
|
7.5
High
|
Jan 27, 2026 |