GR
Monitoring
Grafana
On CISA KEVExploited in the wild
139
CVEs
2
On KEV
9.8
Max CVSS
12
New 30D
Severity mix
Critical 9High 50Medium 74Low 6
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43798 In wildKEV | 7.5 | Dec 7 | Grafana path traversal Affected: >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.8; >= 8.2.0, < 8.2.7; = 8.3.0 |
| CVE-2021-39226 In wildKEV | 7.3 | Oct 5 | Snapshot authentication bypass in grafana Affected: >= 8.0.0, < 8.1.6; < 7.5.11 |
| CVE-2026-15815 | 8.8 | Sep 17 | CVE-2026-15815 CVE Record Affected: 11.6.0 through 11.6.17; 12.0.0; 12.1.0; 12.2.0; 12.3.0; 12.4.0 through 12.4.10; +3 more |
| CVE-2026-11769 | 8.8 | Jun 13 | Operator - Namespaced User Path Traversal Affected: through 5.23.0 |
| CVE-2024-9264 | 8.8 | Oct 18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input Affected: 11.0.0 |
| CVE-2024-1442 | 8.8 | Mar 7 | A user with the permissions to create a data source can use Grafana API to create a data source with UID set to * Affected: 8.5.0 before 9.5.7; 10.0.0 before 10.0.12; 10.1.0 before 10.1.8; 10.2.0 before 10.2.5; 10.3.0 before 10.3.4 |
| CVE-2022-23498 | 8.8 | Feb 3 | Grafana is an open-source platform for monitoring and observability Affected: 8.3.1 before 9.2.10; 9.3.0 before 9.3.4; 8.3.0; 8.3.0 |
| CVE-2022-24812 | 8.8 | Apr 12 | Grafana is an open-source platform for monitoring and observability Affected: 8.1.0 before 8.4.6 |
| CVE-2022-21703 | 8.8 | Feb 8 | Grafana is an open-source platform for monitoring and observability Affected: 3.0.1 before 7.5.15; 8.0.0 before 8.3.5; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +3 more |
| CVE-2022-31097 | 8.7 | Jul 15 | Grafana is an open-source platform for monitoring and observability Affected: 8.0.0 before 8.3.10; 8.4.0 before 8.4.10; 8.5.0 before 8.5.9; 9.0.0 before 9.0.3 |
| CVE-2026-15583 | 8.6 | Jul 15 | SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header Affected: 0.0.0 through 0.17.1 |
| CVE-2022-29170 | 8.5 | May 20 | Grafana is an open-source platform for monitoring and observability Affected: 7.4.0 before 7.5.16; 8.0.0 before 8.5.3 |
| CVE-2020-13379 | 8.2 | Jun 3 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue Affected: 3.0.1 through 7.0.1 |
| CVE-2026-14199 | 8.1 | Sep 2 | Session takeover via Auth Proxy cache key collision Affected: 11.0.0 through 11.6.17; 12.0.0 through 12.2.11; 12.3.0 through 12.3.11; 12.4.0 through 12.4.9; 13.0.0 through 13.0.7; 13.1.0 through 13.1.4; +1 more |
| CVE-2026-28381 | 8.1 | Jun 22 | Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT Affected: 1.14.7 through 1.14.12 |
| CVE-2026-33381 | 8.1 | May 13 | Users can generate Service Account tokens after permissions removal Affected: 9.2.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-21721 | 8.1 | Jan 27 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action Affected: 10.2.0 before 11.6.9; 12.0.0 before 12.0.8; 12.1.0 before 12.1.5; 12.2.0 before 12.2.3; 11.6.9; 12.0.8; +4 more |
| CVE-2022-39306 | 8.1 | Nov 9 | Grafana is an open-source platform for monitoring and observability Affected: 8.0.0 before 8.5.15; 9.0.0 before 9.2.4 |
| CVE-2022-39328 | 8.1 | Nov 8 | Grafana is an open-source platform for monitoring and observability Affected: 9.2.0 before 9.2.4 |
| CVE-2022-31123 | 7.8 | Oct 13 | Grafana plugin signature bypass vulnerability Affected: < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2026-75889 | 7.7 | Aug 27 | CVE-2026-75889 CVE Record Affected: 1.0.0 through 1.18.1 |
| CVE-2026-42129 | 7.7 | Jun 22 | Path traversal in the Loki data source plugin Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-21729 | 7.5 | Jul 16 | Loki detected_fields query limits results in unbounded memory allocation Affected: v3.0.0 before v3.7.0 |
| CVE-2026-8609 | 7.5 | Jul 10 | Pre-authentication denial of service via the OAuth login route Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-33382 | 7.5 | Jul 10 | Denial of service via unbounded request body size Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-42127 | 7.5 | Jun 22 | Pre-authentication denial of service in the public dashboard query endpoint Affected: 11.6.0 through 11.6.14; 12.2.0 through 12.2.8; 12.3.0 through 12.3.6; 12.4.0 through 12.4.3; 13.0.0 through 13.0.1 |
| CVE-2026-21728 | 7.5 | Apr 24 | Tempo query limit results in unbounded memory allocation Affected: 1.0.0 through 2.8.7 |
| CVE-2026-27880 | 7.5 | Mar 27 | OpenFeature evaluation API reads input data with no bounds Affected: v12.1.0 before v12.1.10; v12.2.0 before v12.2.8; v12.3.0 before v12.3.6; v12.4.0 before v12.4.2 |
| CVE-2026-27877 | 7.5 | Mar 27 | Public dashboards discloses all direct mode datasources Affected: 9.3.0 before 11.6.14; 12.0.0 before 12.1.10; 12.2.0 before 12.2.8; 12.3.0 before 12.3.6; 12.4.0 before 12.4.2 |
| CVE-2026-28377 | 7.5 | Mar 26 | S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) Affected: 2.10.3 |
| CVE-2026-21720 | 7.5 | Jan 27 | Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image Affected: 3.0.0 before 11.6.9; 3.0.0 before 11.6.9; 12.0.0 before 12.0.8; 12.0.0 before 12.0.8; 12.1.0 before 12.1.5; 12.1.0 before 12.1.5; +4 more |
| CVE-2023-1387 | 7.5 | Apr 26 | Grafana is an open-source platform for monitoring and observability Affected: 9.1.0 before 9.2.17; 9.3.0 before 9.3.13; 9.4.0 before 9.4.9 |
| CVE-2022-31130 | 7.5 | Oct 13 | Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins Affected: < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2022-39201 | 7.5 | Oct 13 | Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins Affected: >= v5.0.0-beta1, < 8.5.14; >= 9.0.0, < 9.1.8 |
| CVE-2022-31107 | 7.5 | Jul 15 | Grafana is an open-source platform for monitoring and observability Affected: 5.3.0 before 8.3.10; 8.4.0 before 8.4.10; 8.5.0 before 8.5.9; 9.0.0 before 9.0.3 |
| CVE-2022-32276 | 7.5 | Jun 17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI Affected: 8.4.3 |
| CVE-2022-32275 | 7.5 | Jun 6 | Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/ Affected: 8.4.3 |
| CVE-2021-28148 | 7.5 | Mar 22 | One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication Affected: 6.0.0 before 6.7.6; 7.0.0 before 7.3.10; 7.4.0 before 7.4.5 |
| CVE-2021-27358 | 7.5 | Mar 18 | The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used… Affected: 6.7.3 through 7.4.1 |
| CVE-2019-15043 | 7.5 | Sep 3 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use Affected: 2.0.0 before 5.4.5; 6.0.0 before 6.3.4 |
| CVE-2026-33376 | 7.4 | May 13 | Auth Proxy IPv6 whitelist bypass Affected: 9.4.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-76154 | 7.3 | Sep 17 | CVE-2026-76154 CVE Record Affected: 12.3.0; 12.4.0 through 12.4.10; 13.0.0 through 13.0.8; 13.1.0 through 13.1.5; 13.2.0 through 13.2.1 |
| CVE-2023-4399 | 7.2 | Oct 17 | Grafana is an open-source platform for monitoring and observability Affected: 9.4.0 before 9.4.17; 9.5.0 before 9.5.13; 10.0.0 before 10.0.9; 10.1.0 before 10.1.5 |
| CVE-2023-4822 | 7.2 | Oct 16 | Grafana is an open-source platform for monitoring and observability Affected: 8.0.0 before 9.4.16; 9.5.0 before 9.5.11; 10.0.0 before 10.0.7; 10.1.0 before 10.1.3; 10.1.4 |
| CVE-2021-41244 | 7.2 | Nov 15 | Grafana is an open-source platform for monitoring and observability Affected: 8.0.0 before 8.2.4 |
| CVE-2026-9703 | 7.1 | Oct 15 | Viewer role can create, modify and delete Loki alerting rules Affected: 12.3.0 through 12.3.8; 12.4.0 through 12.4.5; 8.0.0 through 12.3.0; 13.0.0 through 13.0.3 |
| CVE-2026-17183 | 7.1 | Aug 19 | CVE-2026-17183 CVE Record Affected: 8.4.0 before 12.3.11; 12.4.0 before 12.4.9; 13.0.0 before 13.0.7; 13.1.0 before 13.1.4 |
| CVE-2026-9765 | 7.1 | Jul 24 | CVE-2026-9765 CVE Record Affected: 1.0.0 through 1.164.0 |
| CVE-2026-33377 | 7.1 | May 13 | Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin Affected: 8.5.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2021-27962 | 7.1 | Mar 22 | Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to… Affected: 7.2.0 before 7.3.10; 7.4.0 before 7.4.5 |
Showing 50