Login Request a demo
GR
Monitoring
Grafana
by Grafana · last CVE Oct 28, 2026
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
9.9
Max CVSS
13
New 30D
Vulnerabilities171In the news1Timeline
Severity mix
Critical 11High 61Medium 89Low 10
Severity
All severities171Critical11High61Medium89Low10
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Grafana to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-12704
6.8
0%
Sep 2
SAML assertion replay via skipped InResponseTo validation
Affected: 11.6.0 through 11.6.17; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 through 12.4.10; 13.0.0 through 13.0.7; 13.1.0 through 13.1.4; +1 more
CVE-2026-17033
6.8
0%
Aug 24
CVE-2026-17033 CVE Record
Affected: through 12.3.11; 12.4.0 through 12.4.9; 13.0.0 through 13.0.7
CVE-2025-2703
6.8
16%
Apr 23
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability
Affected: 11.6.0 before 11.6.0+security-01; 11.5.0 before 11.5.3+security-01; 11.4.0 before 11.4.3+security-01; 11.3.0 before 11.3.5+security-01; 11.2.0 before 11.2.8+security-01
CVE-2026-92539
6.7
0%
Oct 20
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Affected: 11.6.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2022-35957
6.6
2%
Sep 20
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Affected: > 9.0.0, < 9.1.6; < 8.5.13
CVE-2026-88858
New
6.5
0%
Oct 28
Server-side expression parser denial of service
Affected: 7.4.0 through 11.6.16; 12.0.0 through 12.2.10; 12.3.0 through 12.3.11; 12.4.0 through 12.4.13; 13.0.0 through 13.0.11; 13.1.0 through 13.1.8; +1 more
CVE-2026-16491
New
6.5
0%
Oct 27
CVE-2026-16491 CVE Record
Affected: 13.0.0 through 13.0.4; 13.1.0 through 13.1.1; 13.0.0 through 13.1.0
CVE-2026-33374
6.5
0%
Oct 13
Unbounded memory allocation in the Prometheus rule conversion API
Affected: 12.0.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-15577
6.5
0%
Oct 13
Git Sync connection configuration can be modified with read-only access
Affected: 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-89039
6.5
0%
Oct 5
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Affected: 0.3.0 before 0.7.0
CVE-2026-19475
6.5
0%
Sep 2
SQL Data Source Plugin: OOM DoS via $__timeGroup macro
Affected: 13.0.0 through 13.0.1
CVE-2026-27878
6.5
0%
Jun 19
Tempo TraceQL query with exemplar hint could result in unbounded memory usage
Affected: 2.6.1 before 2.8.8
CVE-2026-33378
6.5
0%
May 13
Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
Affected: 8.0.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28383
6.5
0%
May 13
Grafana plugin resources can lead to unbounded memory allocation
Affected: 6.7.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-33380
6.5
0%
May 13
SQL Expressions Read File From Disk
Affected: 11.6.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28380
6.5
0%
May 13
BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
Affected: 9.4.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28376
6.5
0%
May 13
Grafana Live push endpoint allows unbounded memory allocation leading to OOM
Affected: 8.0.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28379
6.5
0%
May 13
Viewer-triggered race condition in Grafana Live leads to complete server crash
Affected: 8.2.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2025-12141
6.5
0%
Apr 15
Grafana Alerting Editors can edit destination of webhooks they did not create
Affected: 8.0.0 through 12.3.0
CVE-2026-27879
6.5
0%
Mar 27
Query resampling can cause unbounded memory allocations
Affected: 8.0.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2
CVE-2026-28375
6.5
0%
Mar 27
Grafana Testdata datasource can issue unbounded memory allocations
Affected: 8.1.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2
CVE-2026-33375
6.5
0%
Mar 26
Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
Affected: 11.6.0 before 11.6.14+security-01; 12.1.0 before 12.1.10+security-01; 12.2.0 before 12.2.8+security-01; 12.3.0 before 12.3.6+security-01; 12.4.0 before 12.4.2
CVE-2024-1313
6.5
1%
Mar 26
Users outside an organization can delete a snapshot with its key
Affected: 9.5.0 before 9.5.18; 10.0.0 before 10.0.13; 10.1.0 before 10.1.9; 10.2.0 before 10.2.6; 10.3.0 before 10.3.5
CVE-2021-28147
6.5
2%
Mar 22
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue
Affected: 6.0.0 before 6.7.6; 7.0.0 before 7.3.10; 7.4.0 before 7.4.5
CVE-2021-28146
6.5
1%
Mar 22
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue
Affected: 7.4.0 before 7.4.5
CVE-2019-19499
6.5
4%
Aug 28
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations
Affected: through 6.4.3
CVE-2018-19039
6.5
7%
Dec 13
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions
Affected: before 4.6.5; 5.0.0 before 5.3.3
CVE-2023-2183
6.4
1%
Jun 6
Grafana is an open-source platform for monitoring and observability
Affected: 8.0.0 before 8.5.26; 9.0.0 before 9.2.19; 9.3.0 before 9.3.15; 9.4.0 before 9.4.12; 9.5.0 before 9.5.3
CVE-2026-93294
6.3
0%
Oct 13
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Affected: 8.1.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-19197
6.3
0%
Aug 26
Broken access control in dashboard snapshots
Affected: 12.4.0 before 12.4.8; 13.0.0 before 13.0.6; 13.1.0 before 13.1.3
CVE-2026-19854
6.1
0%
Aug 27
CVE-2026-19854 CVE Record
Affected: 3.1.0 through 4.20.0
CVE-2025-41117
6.1
0%
Feb 12
XSS in Grafana Explore stack trace
Affected: 12.2.0 before 12.2.4+security-01; 12.3.0 before 12.3.2+security-01
CVE-2025-4123
6.1
97%
May 22
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect
Affected: 10.4.18+security-01 before 10.4.19; 11.2.9+security-01 before 11.2.10; 11.3.6+security-01 before 11.3.7; 11.4.4+security-01 before 11.4.5; 11.5.4+security-01 before 11.5.5; 11.6.1+security-01 before 11.6.2; +1 more
CVE-2023-3010
6.1
1%
Oct 25
Grafana is an open-source platform for monitoring and observability
Affected: 0.3.30 before 1.0.4
CVE-2021-41174
6.1
85%
Nov 3
XSS vulnerability allowing arbitrary JavaScript execution
Affected: >= 8.0.0, < 8.2.3
CVE-2020-24303
6.1
2%
Oct 28
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource
Affected: through 7.0.5
CVE-2018-18625
6.1
1%
Jun 2
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen
Affected: 5.3.1
CVE-2018-18624
6.1
1%
Jun 2
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen
Affected: 5.3.1
CVE-2018-18623
6.1
2%
Jun 2
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen
Affected: 5.3.1
CVE-2020-13430
6.1
2%
May 24
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource
Affected: before 7.0.0
CVE-2020-12052
6.1
1%
Apr 27
Grafana version < 6.7.3 is vulnerable for annotation popup XSS
Affected: before 6.7.3
CVE-2020-12245
6.1
2%
Apr 24
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip
Affected: before 6.7.3
CVE-2018-12099
6.1
2%
Jun 11
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links
Affected: through 5.1.3
CVE-2026-79656
New
6.0
0%
Oct 28
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
Affected: through 12.3.11; 12.4.0 before 12.4.11; 13.0.0 before 13.0.9; 13.1.0 before 13.1.6; 13.2.0 before 13.2.2
CVE-2025-3580
5.5
0%
May 23
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account
Affected: 12.0.0 before 12.0.1; 11.6.1 before 11.6.2; 11.5.4 before 11.5.5; 11.4.4 before 11.4.5; 11.3.6 before 11.3.7; 11.2.9 before 11.2.10; +1 more
CVE-2020-12458
5.5
0%
Apr 29
An information-disclosure flaw was found in Grafana through 6.7.3
Affected: through 6.7.3
CVE-2020-12459
5.5
0%
Apr 29
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a…
Affected: 6.0.0 through 6.3.6
CVE-2026-13720
5.4
0%
Sep 30
Editor can forge file-provisioning provenance on dashboards via the dashboard API
Affected: 12.0.0 through 12.0.10; 12.1.0 through 12.1.10; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 before 12.4.12; 13.0.0 before 13.0.10; +2 more
CVE-2026-8595
5.4
0%
Jul 10
Stored XSS in the table panel (TableNG)
Affected: 12.4.0 through 12.4.3; 13.0.0 through 13.0.1
CVE-2026-9029
5.4
0%
Jun 22
Stored XSS in the Geomap panel tile-layer attribution
Affected: 12.4.0 through 12.4.3; 13.0.0 through 13.0.1
Page 1 of 2 · 89 total
12