Grafana vulnerabilities | LiveThreat CVE Feed

Monitoring

Grafana

by Grafana · last CVE Oct 27, 2026

On CISA KEVExploited in the wild

139

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities139 In the news1 Timeline

Severity mix

Critical 9High 50Medium 74Low 6

Severity

All severities139 Critical9 High50 Medium74 Low6

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Grafana to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-41115	9.8	17%	Nov 21	SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user… Affected: 12.0.0 before 12.2.1
CVE-2023-3128	9.8	4%	Jun 22	Grafana is validating Azure AD accounts based on the email claim Affected: 6.7.0 before 8.5.27; 6.7.0 before 8.5.27; 9.2.0 before 9.2.20; 9.2.0 before 9.2.20; 9.3.0 before 9.3.16; 9.3.0 before 9.3.16; +4 more
CVE-2022-28660	9.8	1%	May 20	The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used Affected: 1.1.0 before 1.2.1; 1.3.0
CVE-2022-26148	9.8	53%	Mar 21	An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix Affected: through 7.3.4
CVE-2020-27846	9.8	5%	Dec 21	A signature verification vulnerability exists in crewjam/saml Affected: before 6.7.5; 7.0.0 before 7.2.3; 7.3.0 before 7.3.6
CVE-2018-15727	9.8	64%	Aug 29	Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of… Affected: 2.0.0 through 2.1.2; 3.0.0 through 3.1.1; 4.0.0 before 4.6.4; 5.0.0 before 5.2.3
CVE-2026-19516	9.1	0%	Aug 11	CVE-2026-19516 CVE Record Affected: 0.0.0 through 1.0.0
CVE-2025-41118	9.1	0%	Apr 15	Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection Affected: 1.0.0 before 1.16.0
CVE-2026-27876	9.1	2%	Mar 27	RCE on Grafana via sqlExpressions Affected: 11.6.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2