Login Request a demo
GR
Monitoring
Grafana
by Grafana · last CVE Oct 28, 2026
On CISA KEVExploited in the wild
140
CVEs
2
On KEV
9.8
Max CVSS
13
New 30D
Vulnerabilities140In the news1Timeline
Severity mix
Critical 9High 50Medium 75Low 6
Severity
All severities140Critical9High50Medium75Low6
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Grafana to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-76154
7.3
0%
Sep 17
CVE-2026-76154 CVE Record
Affected: 12.3.0; 12.4.0 through 12.4.10; 13.0.0 through 13.0.8; 13.1.0 through 13.1.5; 13.2.0 through 13.2.1
CVE-2023-4399
7.2
1%
Oct 17
Grafana is an open-source platform for monitoring and observability
Affected: 9.4.0 before 9.4.17; 9.5.0 before 9.5.13; 10.0.0 before 10.0.9; 10.1.0 before 10.1.5
CVE-2023-4822
7.2
1%
Oct 16
Grafana is an open-source platform for monitoring and observability
Affected: 8.0.0 before 9.4.16; 9.5.0 before 9.5.11; 10.0.0 before 10.0.7; 10.1.0 before 10.1.3; 10.1.4
CVE-2021-41244
7.2
3%
Nov 15
Grafana is an open-source platform for monitoring and observability
Affected: 8.0.0 before 8.2.4
CVE-2026-9703
7.1
0%
Oct 15
Viewer role can create, modify and delete Loki alerting rules
Affected: 12.3.0 through 12.3.8; 12.4.0 through 12.4.5; 8.0.0 through 12.3.0; 13.0.0 through 13.0.3
CVE-2026-17183
7.1
0%
Aug 19
CVE-2026-17183 CVE Record
Affected: 8.4.0 before 12.3.11; 12.4.0 before 12.4.9; 13.0.0 before 13.0.7; 13.1.0 before 13.1.4
CVE-2026-9765
7.1
0%
Jul 24
CVE-2026-9765 CVE Record
Affected: 1.0.0 through 1.164.0
CVE-2026-33377
7.1
0%
May 13
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
Affected: 8.5.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2021-27962
7.1
2%
Mar 22
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to…
Affected: 7.2.0 before 7.3.10; 7.4.0 before 7.4.5
CVE-2026-12704
6.8
0%
Sep 2
SAML assertion replay via skipped InResponseTo validation
Affected: 11.6.0 through 11.6.17; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 through 12.4.10; 13.0.0 through 13.0.7; 13.1.0 through 13.1.4; +1 more
CVE-2026-17033
6.8
0%
Aug 24
CVE-2026-17033 CVE Record
Affected: through 12.3.11; 12.4.0 through 12.4.9; 13.0.0 through 13.0.7
CVE-2026-92539
6.7
0%
Oct 20
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Affected: 11.6.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2022-35957
6.6
2%
Sep 20
Grafana is an open-source platform for monitoring and observability
Affected: before 8.5.13; 9.0.0 before 9.0.9; 9.1.0 before 9.1.6
CVE-2026-16491
New
6.5–Oct 27
CVE-2026-16491 CVE Record
Affected: 13.0.0 through 13.0.4; 13.1.0 through 13.1.1; 13.0.0 through 13.1.0
CVE-2026-33374
6.5
0%
Oct 13
Unbounded memory allocation in the Prometheus rule conversion API
Affected: 12.0.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-15577
6.5
0%
Oct 13
Git Sync connection configuration can be modified with read-only access
Affected: 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-89039
6.5
0%
Oct 5
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Affected: 0.3.0 before 0.7.0
CVE-2026-19475
6.5
0%
Sep 2
SQL Data Source Plugin: OOM DoS via $__timeGroup macro
Affected: 13.0.0 through 13.0.1
CVE-2026-27878
6.5
0%
Jun 19
Tempo TraceQL query with exemplar hint could result in unbounded memory usage
Affected: 2.6.0 before 2.10.2
CVE-2026-33378
6.5
0%
May 13
Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
Affected: 8.0.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28383
6.5
0%
May 13
Grafana plugin resources can lead to unbounded memory allocation
Affected: 6.7.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-33380
6.5
0%
May 13
SQL Expressions Read File From Disk
Affected: 11.6.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28380
6.5
0%
May 13
BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
Affected: 9.4.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28376
6.5
0%
May 13
Grafana Live push endpoint allows unbounded memory allocation leading to OOM
Affected: 8.0.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2026-28379
6.5
0%
May 13
Viewer-triggered race condition in Grafana Live leads to complete server crash
Affected: 8.2.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more
CVE-2025-12141
6.5
0%
Apr 15
Grafana Alerting Editors can edit destination of webhooks they did not create
Affected: 8.0.0 through 12.3.0
CVE-2026-27879
6.5
0%
Mar 27
Query resampling can cause unbounded memory allocations
Affected: 8.0.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2
CVE-2026-28375
6.5
0%
Mar 27
Grafana Testdata datasource can issue unbounded memory allocations
Affected: 8.1.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2
CVE-2026-33375
6.5
0%
Mar 26
Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
Affected: 11.6.0 before 11.6.14+security-01; 12.1.0 before 12.1.10+security-01; 12.2.0 before 12.2.8+security-01; 12.3.0 before 12.3.6+security-01; 12.4.0 before 12.4.2
CVE-2021-28147
6.5
2%
Mar 22
The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue
Affected: 6.0.0 before 6.7.6; 7.0.0 before 7.3.10; 7.4.0 before 7.4.5
CVE-2021-28146
6.5
1%
Mar 22
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue
Affected: 7.4.0 before 7.4.5
CVE-2019-19499
6.5
4%
Aug 28
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations
Affected: through 6.4.3
CVE-2018-19039
6.5
7%
Dec 13
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions
Affected: before 4.6.5; 5.0.0 before 5.3.3
CVE-2023-2183
6.4
1%
Jun 6
Grafana is an open-source platform for monitoring and observability
Affected: 8.0.0 before 8.5.26; 9.0.0 before 9.2.19; 9.3.0 before 9.3.15; 9.4.0 before 9.4.12; 9.5.0 before 9.5.3
CVE-2026-93294
6.3
0%
Oct 13
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Affected: 8.1.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4
CVE-2026-19197
6.3
0%
Aug 26
Broken access control in dashboard snapshots
Affected: 12.4.0 before 12.4.8; 13.0.0 before 13.0.6; 13.1.0 before 13.1.3
CVE-2026-19854
6.1
0%
Aug 27
CVE-2026-19854 CVE Record
Affected: 3.1.0 through 4.20.0
CVE-2025-41117
6.1
0%
Feb 12
XSS in Grafana Explore stack trace
Affected: 12.2.0 before 12.2.4+security-01; 12.3.0 before 12.3.2+security-01
CVE-2025-4123
6.1
97%
May 22
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect
Affected: before 10.4.18; 11.2.0 before 11.2.9; 11.3.0 before 11.3.6; 11.4.0 before 11.4.4; 11.5.0 before 11.5.4; 11.6.0 before 11.6.1; +7 more
CVE-2021-41174
6.1
85%
Nov 3
Grafana is an open-source platform for monitoring and observability
Affected: 8.0.0 before 8.2.3
CVE-2020-24303
6.1
2%
Oct 28
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource
Affected: through 7.0.5
CVE-2018-18625
6.1
1%
Jun 2
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen
Affected: 5.3.1
CVE-2018-18624
6.1
1%
Jun 2
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen
Affected: 5.3.1
CVE-2018-18623
6.1
2%
Jun 2
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen
Affected: 5.3.1
CVE-2020-13430
6.1
2%
May 24
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource
Affected: before 7.0.0
CVE-2020-12052
6.1
1%
Apr 27
Grafana version < 6.7.3 is vulnerable for annotation popup XSS
Affected: before 6.7.3
CVE-2020-12245
6.1
2%
Apr 24
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip
Affected: before 6.7.3
CVE-2018-12099
6.1
2%
Jun 11
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links
Affected: through 5.1.3
CVE-2026-79656
New
6.0–Oct 28
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
Affected: through 12.3.11; 12.4.0 before 12.4.11; 13.0.0 before 13.0.9; 13.1.0 before 13.1.6; 13.2.0 before 13.2.2
CVE-2020-12459
5.5
0%
Apr 29
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a…
Affected: 6.0.0 through 6.3.6
Page 2 of 3 · 140 total
123