Vulnerability Database · Go · Package report
github.com/grafana/grafana: vulnerability history, versions and safety
github.com/grafana/grafana is a package in the Go ecosystem. Vulert records 117 vulnerabilities for it across 120 releases, from Oct 2021 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
No patched version yet — these are the ones to plan around.
See the unfixed vulnerabilities →No published version shipped hostile code.
Vulert verdict on github.com/grafana/grafana v6.1.6+incompatible i
Updated on 23 Oct 2026
Careful: 49 of the 117 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.
- Security Unfixed issues
- Maintenance Sustainable
- Popularity Key ecosystem project
- Community Active
What to do: Plan around the 49 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →
- Current release v6.1.6+incompatible — unaffected i
- Vulnerabilities on record 117 over 5 years · 22 in the last year i
- Latest disclosure 07 Oct 2026 i
- Highest CVSS 10.0 i
- With no published fix 49 i
- Stars 77,421 i
- OpenSSF scorecard 7/10 i
- Last release this month i
- Licence AGPL-3.0 i
Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for github.com/grafana/grafana, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- v0.0.0-20261022161221-5f006c273116 22 Oct 2026
- v0.0.0-20261022160815-4cf34624d269 22 Oct 2026
- v0.0.0-20261022160046-3f82de3fbb4d 22 Oct 2026
- v0.0.0-20261022155744-097fd74317f8 22 Oct 2026
- v0.0.0-20261022154235-26c686ab0b92 22 Oct 2026
- v0.0.0-20261022153718-c194b6704374 22 Oct 2026
- v0.0.0-20261022152613-9bb505592373 22 Oct 2026
- v0.0.0-20261022152218-7816dbb53226 22 Oct 2026
- v0.0.0-20261022152004-97410215d82c 22 Oct 2026
- v0.0.0-20261022150520-912245a8bf8b 22 Oct 2026
- v0.0.0-20261022145822-3420e13ba94e 22 Oct 2026
- v0.0.0-20261022145140-02d0b0c25f3e 22 Oct 2026
- v0.0.0-20261022140902-54e627e0ac0d 22 Oct 2026
- v0.0.0-20261022140441-689a0b33d657 22 Oct 2026
- v0.0.0-20261022135627-c630921012ba 22 Oct 2026
- v0.0.0-20261022135143-825d37210169 22 Oct 2026
- v0.0.0-20261022134345-0e70bc3a124d 22 Oct 2026
- v0.0.0-20261022132614-eaa78857ba8a 22 Oct 2026
- v0.0.0-20261022132505-71f3db91e990 22 Oct 2026
- v0.0.0-20261022132111-51b230f1ad18 22 Oct 2026
- v0.0.0-20261022131455-ba36a22d99f8 22 Oct 2026
- v0.0.0-20261022131000-36be0c89ce1b 22 Oct 2026
- v0.0.0-20261022130826-37e766c979e7 22 Oct 2026
- v0.0.0-20261022130410-464d00949634 22 Oct 2026
- v0.0.0-20261022130001-38d89a488635 22 Oct 2026
- v0.0.0-20261022125402-c1d9cc4b47a2 22 Oct 2026
- v0.0.0-20261022124740-35070feb38a3 22 Oct 2026
- v0.0.0-20261022121617-811e0c01ae4a 22 Oct 2026
- v0.0.0-20261022115852-08d2daecfb99 22 Oct 2026
- v0.0.0-20261022115448-e943456bc5ac 22 Oct 2026
- v0.0.0-20261022112406-d4db0470ffc0 22 Oct 2026
- v0.0.0-20261022111810-5e135cda7600 22 Oct 2026
- v0.0.0-20261022110510-bc4b32aabb47 22 Oct 2026
- v0.0.0-20261022105953-9f8e114e900a 22 Oct 2026
- v0.0.0-20261022103556-f63ee8a407bc 22 Oct 2026
- v0.0.0-20261022100809-7d44f6fc1a36 22 Oct 2026
- v0.0.0-20261022093323-eafb3a779529 22 Oct 2026
- v0.0.0-20261022090320-8f7032889aa5 22 Oct 2026
- v0.0.0-20261022083642-bac934f04259 22 Oct 2026
- v0.0.0-20261022082404-32f4f103c56c 22 Oct 2026
- v0.0.0-20261022081600-c83d45771f8a 22 Oct 2026
- v0.0.0-20261022075637-614b8dc7831a 22 Oct 2026
- v0.0.0-20261022075426-361ff4bb5262 22 Oct 2026
- v0.0.0-20261022074733-47e674de3e5c 22 Oct 2026
- v0.0.0-20261022074325-96de1918a0d4 22 Oct 2026
- v0.0.0-20261022073518-6fbfae675bc2 22 Oct 2026
- v0.0.0-20261022072652-50c0ef6afae6 22 Oct 2026
- v0.0.0-20261022070800-f7e65c6c628a 22 Oct 2026
- v0.0.0-20261022070520-3e9745e5013f 22 Oct 2026
- v0.0.0-20261022062346-756fe9280061 22 Oct 2026
- v0.0.0-20261022000032-e40de7898e1c 22 Oct 2026
- v0.0.0-20261021234007-7fea201d0f4a 21 Oct 2026
- v0.0.0-20261021214819-0be7d5b210a4 21 Oct 2026
- v0.0.0-20261021213950-1333a47e22d1 21 Oct 2026
- v0.0.0-20261021203454-7de573e4db63 21 Oct 2026
- v0.0.0-20261021203333-fe9934b67e75 21 Oct 2026
- v0.0.0-20261021201250-770a08e1623c 21 Oct 2026
- v0.0.0-20261021183623-75d6810efccb 21 Oct 2026
- v0.0.0-20261021182126-80c3bc368425 21 Oct 2026
- v0.0.0-20261021173741-7bec0f27f4c9 21 Oct 2026
- v0.0.0-20261021173316-4451964cd8fb 21 Oct 2026
- v0.0.0-20261021171006-657a531e9387 21 Oct 2026
- v0.0.0-20261021164740-567e34cbc275 21 Oct 2026
- v0.0.0-20261021163025-b36eea198358 21 Oct 2026
- v0.0.0-20261021150956-ce73ac3b2a88 21 Oct 2026
- v0.0.0-20261021144358-2db8025937b1 21 Oct 2026
- v0.0.0-20261021141928-a9ae7fe4db68 21 Oct 2026
- v0.0.0-20261021132817-2351b7e52b43 21 Oct 2026
- v0.0.0-20261021123430-36a15b576605 21 Oct 2026
- v0.0.0-20261021102316-6a9a24118330 21 Oct 2026
- v0.0.0-20261021090313-2a6ca876e676 21 Oct 2026
- v0.0.0-20261021075621-0166366eca50 21 Oct 2026
- v0.0.0-20261021074216-880394810330 21 Oct 2026
- v0.0.0-20261021070621-202784072c7d 21 Oct 2026
- v0.0.0-20261021065453-2324b5584ee6 21 Oct 2026
- v0.0.0-20261021060811-30770908902a 21 Oct 2026
- v0.0.0-20261021050358-2ae86760faa2 21 Oct 2026
- v0.0.0-20261021000312-951a0b83aa69 21 Oct 2026
- v0.0.0-20261020234119-1bc638c7e51f 20 Oct 2026
- v0.0.0-20261020225302-356ba5e88d2a 20 Oct 2026
- v0.0.0-20261020222056-215f14835c73 20 Oct 2026
- v0.0.0-20261020215243-cd381de7b778 20 Oct 2026
- v0.0.0-20261020202144-3025c5a4a0a8 20 Oct 2026
- v0.0.0-20261020191559-719d0606b76b 20 Oct 2026
- v0.0.0-20261020185114-0749faeffc63 20 Oct 2026
- v0.0.0-20261020183503-84225fd19cb3 20 Oct 2026
- v0.0.0-20261020183033-073b06875b15 20 Oct 2026
- v0.0.0-20261020181921-67dfa31b3590 20 Oct 2026
- v0.0.0-20261020175243-330f73c238f9 20 Oct 2026
- v0.0.0-20261020172358-687fda65038e 20 Oct 2026
- v0.0.0-20261020172231-f4c59309c125 20 Oct 2026
- v0.0.0-20261020171509-65dab7ff6532 20 Oct 2026
- v0.0.0-20261020170449-d9e2333ca18b 20 Oct 2026
- v0.0.0-20261020170254-b5988fe1377c 20 Oct 2026
- v0.0.0-20261020165156-1c052066a899 20 Oct 2026
- v0.0.0-20261020161824-82bd83244971 20 Oct 2026
- v0.0.0-20261020160225-7c22c85a8943 20 Oct 2026
- v0.0.0-20261020155000-014e4273a716 20 Oct 2026
- v0.0.0-20261020154101-248b37fe422e 20 Oct 2026
- v0.0.0-20261020153535-2592f402d92c 20 Oct 2026
- v0.0.0-20261020152336-1eaf0f98b4f2 20 Oct 2026
- v0.0.0-20261020151239-307dbbe93db6 20 Oct 2026
- v0.0.0-20261020145613-59f69a98ab53 20 Oct 2026
- v0.0.0-20261020143145-91cca2a201de 20 Oct 2026
- v0.0.0-20261020140157-a0a372417c65 20 Oct 2026
- v0.0.0-20261020134258-993782cdb6bf 20 Oct 2026
- v0.0.0-20261020132528-b1b14fda9fcb 20 Oct 2026
- v0.0.0-20261020120702-e844a74d7795 20 Oct 2026
- v0.0.0-20261020114755-98f61fe4eb84 20 Oct 2026
- v0.0.0-20261020113019-11c0ea3d7cb9 20 Oct 2026
- v0.0.0-20261020105514-262d614bce85 20 Oct 2026
- v0.0.0-20261020103710-a3e6d0b1abb7 20 Oct 2026
- v0.0.0-20261020084823-804159455cc6 20 Oct 2026
- v0.0.0-20261020084327-42bf57e61033 20 Oct 2026
- v0.0.0-20261020083343-57bca96f71ef 20 Oct 2026
- v0.0.0-20261020080901-976ae3ce4259 20 Oct 2026
- v0.0.0-20261020080127-5935120d439e 20 Oct 2026
- v0.0.0-20261020073648-fb941c457f88 20 Oct 2026
- v0.0.0-20261020071705-1199f3519e8c 20 Oct 2026
- v0.0.0-20261020070610-f57aaab70929 20 Oct 2026
The newest 120 of 20,320 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 22 of the 117 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for github.com/grafana/grafana
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| CVE-2025-41115: Grafana Incorrect Privilege Assignment Vulnerability | 10.0 critical | 12.3.0 | 21 Nov 2025 |
| CVE-2024-9264: Grafana Command Injection and Local File Inclusion Vulnerability | 9.9 critical | 11.0.6+security-01 | 18 Oct 2024 |
| CVE-2022-39328: Grafana Race condition allowing privilege escalation | 9.8 critical | 9.2.4 | 14 May 2024 |
| CVE-2018-15727: Authentication Bypass in Grafana | 9.8 critical | 4.6.4 | 15 Feb 2022 |
| CVE-2023-31287: Insufficient token expiration in Serenity | 9.4 critical | 9.4.13 | 22 Jun 2023 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315