GR
Monitoring
Grafana
On CISA KEVExploited in the wild
153
CVEs
2
On KEV
9.9
Max CVSS
17
New 30D
Severity mix
Critical 10High 54Medium 80Low 9
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-13430 | 6.1 | May 24 | Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource Affected: before 7.0.0 |
| CVE-2020-12052 | 6.1 | Apr 27 | Grafana version < 6.7.3 is vulnerable for annotation popup XSS Affected: before 6.7.3 |
| CVE-2020-12245 | 6.1 | Apr 24 | Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip Affected: before 6.7.3 |
| CVE-2018-12099 | 6.1 | Jun 11 | Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links Affected: through 5.1.3 |
| CVE-2026-79656 New | 6.0 | Oct 28 | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors Affected: through 12.3.11; 12.4.0 before 12.4.11; 13.0.0 before 13.0.9; 13.1.0 before 13.1.6; 13.2.0 before 13.2.2 |
| CVE-2020-12459 | 5.5 | Apr 29 | In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a… Affected: 6.0.0 through 6.3.6 |
| CVE-2020-12458 | 5.5 | Apr 29 | An information-disclosure flaw was found in Grafana through 6.7.3 Affected: through 6.7.3 |
| CVE-2026-13720 | 5.4 | Sep 30 | Editor can forge file-provisioning provenance on dashboards via the dashboard API Affected: 12.0.0 through 12.0.10; 12.1.0 through 12.1.10; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 before 12.4.12; 13.0.0 before 13.0.10; +2 more |
| CVE-2026-8595 | 5.4 | Jul 10 | Stored XSS in the table panel (TableNG) Affected: 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-9029 | 5.4 | Jun 22 | Stored XSS in the Geomap panel tile-layer attribution Affected: 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2023-6152 | 5.4 | Feb 13 | A user changing their email after signing up and verifying it can change it without verification in profile settings Affected: through 2.5.0; 10.0.0; 10.1.0; 10.2.0; 10.3.0 |
| CVE-2023-22462 | 5.4 | Mar 2 | Grafana is an open-source platform for monitoring and observability Affected: 9.2.0 before 9.2.10; 9.3.0 before 9.3.4 |
| CVE-2023-0594 | 5.4 | Mar 1 | Grafana is an open-source platform for monitoring and observability Affected: 7.0.0 before 8.5.21; 9.2.0 before 9.2.13; 9.3.0 before 9.3.8 |
| CVE-2023-0507 | 5.4 | Mar 1 | Grafana is an open-source platform for monitoring and observability Affected: 8.1.0 before 8.5.21; 9.2.0 before 9.2.13; 9.3.0 before 9.3.8 |
| CVE-2022-23552 | 5.4 | Jan 27 | Grafana is an open-source platform for monitoring and observability Affected: 8.1.0 before 8.5.16; 9.0.0 before 9.2.10; 9.3.0 before 9.3.4 |
| CVE-2022-21702 | 5.4 | Feb 8 | Grafana is an open-source platform for monitoring and observability Affected: 2.0.1 before 7.5.15; 8.0.0 before 8.3.5; 2.0.0; 2.0.0 |
| CVE-2020-11110 | 5.4 | Jul 27 | Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed… Affected: through 6.7.1 |
| CVE-2019-13068 | 5.4 | Jun 30 | public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field) Affected: before 6.2.5 |
| CVE-2018-1000816 | 5.4 | Dec 20 | Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js… Affected: 5.2.4; 5.3.0 |
| CVE-2026-95502 | 5.3 | Oct 13 | Git Sync memory exhaustion via a malicious Git server Affected: 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4 |
| CVE-2026-81841 | 5.3 | Sep 29 | Paused shared dashboard access tokens still expose data source configuration Affected: 11.6.0 through 11.6.17; 12.0.0 through 12.0.10; 12.1.0 through 12.1.10; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 before 12.4.12; +3 more |
| CVE-2026-11817 | 5.3 | Aug 17 | CVE-2026-11817 CVE Record Affected: 12.4.0 through 12.4.5; 11.2.0 through 11.6.16; 13.0.0 through 13.0.3; 13.1.0 through 13.1.0; 12.2.0 through 12.2.10; 12.3.0 through 12.3.8 |
| CVE-2026-21723 | 5.3 | Jul 23 | CVE-2026-21723 Record Affected: 8.0.0 through 11.0.0; 11.0.0 through 11.6.10; 12.0.0 through 12.0.9; 12.1.0 through 12.1.6; 12.2.0 through 12.2.4; 12.3.0 through 12.3.2 |
| CVE-2026-21726 | 5.3 | Apr 15 | Loki Path Traversal - CVE-2021-36156 Bypass Affected: 2.3.0 before 3.5.9 |
| CVE-2026-21722 | 5.3 | Feb 12 | Public Dashboards time range restriction on annotations can be bypassed Affected: 9.3.0 before 11.6.10+security-01; 12.0.0 before 12.1.6+security-01; 12.2.0 before 12.2.4+security-01; 12.3.0 before 12.3.2+security-01 |
| CVE-2023-5122 | 5.3 | Feb 14 | Grafana is an open-source platform for monitoring and observability Affected: before 0.6.13 |
| CVE-2023-2801 | 5.3 | Jun 6 | Grafana is an open-source platform for monitoring and observability Affected: 9.4.0 before 9.4.12; 9.5.0 before 9.5.3 |
| CVE-2022-39307 | 5.3 | Nov 9 | Grafana is an open-source platform for monitoring and observability Affected: before 8.5.15; 9.0.0 before 9.2.4 |
| CVE-2025-8341 | 5.0 | Aug 4 | SSRF in Infinity Datasource Plugin Affected: 0.6.0 before 3.4.1 |
| CVE-2019-15635 | 4.9 | Sep 23 | An issue was discovered in Grafana 5.4.0 Affected: 5.4.0 |
| CVE-2023-1410 | 4.8 | Mar 23 | Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip Affected: 8.0.0 before 8.5.22; 9.2.0 before 9.2.15; after 9.3.0 before 9.3.11 |
| CVE-2026-13719 | 4.3 | Sep 30 | Alert rules in restricted folders disclosed via the alert rules list API Affected: 12.3.0 through 12.3.11; 12.4.0 before 12.4.12; 13.0.0 before 13.0.10; 13.1.0 before 13.1.7; 13.2.0 before 13.2.3 |
| CVE-2026-81842 | 4.3 | Sep 29 | Library panel can be moved into a folder without library panel create permission Affected: 12.1.0 through 12.1.10; 12.2.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 before 12.4.12; 13.0.0 before 13.0.10 |
| CVE-2026-10601 | 4.3 | Jun 22 | Path traversal in the Tempo and Loki data source plugins Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-28374 | 4.3 | May 13 | IDOR in Annotations API allows unprivileged users to DELETE annotation Affected: 8.5.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-21724 | 4.3 | Mar 26 | Missing Protected-field Authorization in Provisioning Contact Points API Affected: 12.3.1 before 12.3.6; 12.2.2 before 12.2.8; 12.1.5 before 12.1.10; 11.6.9 before 11.6.14 |
| CVE-2025-10630 | 4.3 | Sep 19 | Regex DoS in Grafana Zabbix Plugin Affected: before 6.0.2 |
| CVE-2025-3415 | 4.3 | Jul 17 | Grafana is an open-source platform for monitoring and observability Affected: 10.4.x before 10.4.19+security-01; 11.2.x before 11.2.10+security-01; 11.3.x before 11.3.7+security-01; 11.4.x before 11.4.5+security-01; 11.5.x before 11.5.5+security-01; 11.6.x before 11.6.2+security-01; +1 more |
| CVE-2022-39229 | 4.3 | Oct 13 | Grafana users with email as a username can block other users from signing in Affected: >= 9.0.0, < 9.1.8; >= 8.5.0, < 8.5.14 |
| CVE-2022-21713 | 4.3 | Feb 8 | Grafana is an open-source platform for monitoring and observability Affected: 5.0.0 before 7.5.15; 8.0.0 before 8.3.5; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +1 more |
| CVE-2022-21673 | 4.3 | Jan 18 | Grafana is an open-source platform for monitoring and observability Affected: 7.2.0 before 7.5.13; 8.0.0 before 8.3.4 |
| CVE-2021-43815 | 4.3 | Dec 10 | Grafana is an open-source platform for monitoring and observability Affected: before 7.5.12; 8.0.0 before 8.3.2 |
| CVE-2021-43813 | 4.3 | Dec 10 | Grafana is an open-source platform for monitoring and observability Affected: 5.0.0 before 7.5.12; 8.0.0 before 8.3.2 |
| CVE-2025-6197 | 4.2 | Jul 18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality Affected: 12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 |
| CVE-2022-36062 | 3.8 | Sep 22 | Grafana is an open-source platform for monitoring and observability Affected: before 8.5.13; 9.0.0 before 9.0.9; 9.1.0 before 9.1.6 |
| CVE-2022-39324 | 3.5 | Jan 27 | Grafana is an open-source platform for monitoring and observability Affected: before 8.5.16; 9.0.0 before 9.2.8 |
| CVE-2026-21727 | 3.3 | Apr 15 | Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record Affected: 10.2.0 before 12.4.0 |
| CVE-2026-28378 | 2.7 | Jul 7 | Cross-Organization Public Dashboard Deletion via Missing Org Isolation Affected: 11.6.0 through 11.6.13; 12.1.0 through 12.1.9; 12.2.0 through 12.2.7; 12.3.0 through 12.3.5; 12.4.0 through 12.4.1 |
| CVE-2025-1088 | 2.7 | Jun 18 | Very long unicode dashboard title or panel name can hang the frontend Affected: before 11.6.2 |
| CVE-2024-10452 | 2.7 | Oct 29 | Organization admins can delete pending invites created in an organization they are not part of Affected: 10.4.0 |