Login Request a demo
GR
Vendor
Grafana
17 products with CVEs on record
161
CVEs
2
On KEV
12
New 30D
Products
GR
Grafana
Monitoring
9.8
139 CVEs2 on KEV12 new
TE
Tempo
Grafana
7.5
3 CVEs0 on KEV0 new
AG
Agent
Grafana
7.8
2 CVEs0 on KEV0 new
EM
Enterprise Metrics
Grafana
8.8
2 CVEs0 on KEV0 new
LO
Loki
Grafana
5.3
2 CVEs0 on KEV0 new
PI
Piechart-panel
Grafana
6.1
2 CVEs0 on KEV0 new
AL
Alloy
Grafana
7.8
1 CVEs0 on KEV0 new
GS
Google Sheets
Grafana
7.5
1 CVEs0 on KEV0 new
GR
Grafana-image-renderer
Grafana
8.1
1 CVEs0 on KEV0 new
GO
Grafana Operator
Grafana
8.8
1 CVEs0 on KEV0 new
JA
Json Api Data Source
Grafana
8.0
1 CVEs0 on KEV0 new
LD
Loki Datasource
Grafana
7.7
1 CVEs0 on KEV0 new
ON
Oncall
Grafana
9.1
1 CVEs0 on KEV0 new
PY
Pyroscope
Grafana
9.1
1 CVEs0 on KEV0 new
SN
Snowflake
Grafana
8.1
1 CVEs0 on KEV0 new
SM
Synthetic Monitoring Agent
Grafana
3.3
1 CVEs0 on KEV0 new
WP
Worldmap Panel
Grafana
6.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-16491
New
GR
Grafana
Grafana
6.5–Oct 27CVE-2026-16491 CVE Record
CVE-2026-92539
GR
Grafana
Grafana
6.7
0%
Oct 20Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
CVE-2026-9703
GR
Grafana
Grafana
7.1
0%
Oct 15Viewer role can create, modify and delete Loki alerting rules
CVE-2026-33374
GR
Grafana
Grafana
6.5
0%
Oct 13Unbounded memory allocation in the Prometheus rule conversion API
CVE-2026-15577
GR
Grafana
Grafana
6.5
0%
Oct 13Git Sync connection configuration can be modified with read-only access
CVE-2026-93294
GR
Grafana
Grafana
6.3
0%
Oct 13Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
CVE-2026-95502
GR
Grafana
Grafana
5.3
0%
Oct 13Git Sync memory exhaustion via a malicious Git server
CVE-2026-89039
GR
Grafana
Grafana
6.5
0%
Oct 5Arbitrary file read via the convert_playwright_script prompt in mcp-k6
CVE-2026-13720
GR
Grafana
Grafana
5.4
0%
Sep 30Editor can forge file-provisioning provenance on dashboards via the dashboard API
CVE-2026-13719
GR
Grafana
Grafana
4.3
0%
Sep 30Alert rules in restricted folders disclosed via the alert rules list API
CVE-2026-81842
GR
Grafana
Grafana
4.3
0%
Sep 29Library panel can be moved into a folder without library panel create permission
CVE-2026-81841
GR
Grafana
Grafana
5.3
0%
Sep 29Paused shared dashboard access tokens still expose data source configuration
CVE-2026-15815
GR
Grafana
Grafana
8.8
1%
Sep 17CVE-2026-15815 CVE Record
CVE-2026-76154
GR
Grafana
Grafana
7.3
0%
Sep 17CVE-2026-76154 CVE Record
CVE-2026-14199
GR
Grafana
Grafana
8.1
0%
Sep 2Session takeover via Auth Proxy cache key collision
CVE-2026-12704
GR
Grafana
Grafana
6.8
0%
Sep 2SAML assertion replay via skipped InResponseTo validation
CVE-2026-19475
GR
Grafana
Grafana
6.5
0%
Sep 2SQL Data Source Plugin: OOM DoS via $__timeGroup macro
CVE-2026-75889
GR
Grafana
Grafana
7.7
0%
Aug 27CVE-2026-75889 CVE Record
CVE-2026-19854
GR
Grafana
Grafana
6.1
0%
Aug 27CVE-2026-19854 CVE Record
CVE-2026-19197
GR
Grafana
Grafana
6.3
0%
Aug 26Broken access control in dashboard snapshots
CVE-2026-17033
GR
Grafana
Grafana
6.8
0%
Aug 24CVE-2026-17033 CVE Record
CVE-2026-17183
GR
Grafana
Grafana
7.1
0%
Aug 19CVE-2026-17183 CVE Record
CVE-2026-11817
GR
Grafana
Grafana
5.3
0%
Aug 17CVE-2026-11817 CVE Record
CVE-2026-19516
GR
Grafana
Grafana
9.1
0%
Aug 11CVE-2026-19516 CVE Record
CVE-2026-9765
GR
Grafana
Grafana
7.1
0%
Jul 24CVE-2026-9765 CVE Record
CVE-2026-21723
GR
Grafana
Grafana
5.3
0%
Jul 23CVE-2026-21723 Record
CVE-2026-21729
GR
Grafana
Grafana
7.5
0%
Jul 16Loki detected_fields query limits results in unbounded memory allocation
CVE-2026-15583
GR
Grafana
Grafana
8.6
1%
Jul 15SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
CVE-2026-8595
GR
Grafana
Grafana
5.4
0%
Jul 10Stored XSS in the table panel (TableNG)
CVE-2026-8609
GR
Grafana
Grafana
7.5
0%
Jul 10Pre-authentication denial of service via the OAuth login route
CVE-2026-33382
GR
Grafana
Grafana
7.5
0%
Jul 10Denial of service via unbounded request body size
CVE-2026-28378
GR
Grafana
Grafana
2.7
0%
Jul 7Cross-Organization Public Dashboard Deletion via Missing Org Isolation
CVE-2026-42127
GR
Grafana
Grafana
7.5
0%
Jun 22Pre-authentication denial of service in the public dashboard query endpoint
CVE-2026-28381
GR
Grafana
Grafana
8.1
0%
Jun 22Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVE-2026-9029
GR
Grafana
Grafana
5.4
0%
Jun 22Stored XSS in the Geomap panel tile-layer attribution
CVE-2026-10601
GR
Grafana
Grafana
4.3
0%
Jun 22Path traversal in the Tempo and Loki data source plugins
CVE-2026-42129
GR
Grafana
Grafana
7.7
0%
Jun 22Path traversal in the Loki data source plugin
CVE-2026-27878
GR
Grafana
Grafana
6.5
0%
Jun 19Tempo TraceQL query with exemplar hint could result in unbounded memory usage
CVE-2026-11769
GR
Grafana
Grafana
8.8
0%
Jun 13Operator - Namespaced User Path Traversal
CVE-2026-28374
GR
Grafana
Grafana
4.3
0%
May 13IDOR in Annotations API allows unprivileged users to DELETE annotation
CVE-2026-33378
GR
Grafana
Grafana
6.5
0%
May 13Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro
CVE-2026-28383
GR
Grafana
Grafana
6.5
0%
May 13Grafana plugin resources can lead to unbounded memory allocation
CVE-2026-33376
GR
Grafana
Grafana
7.4
0%
May 13Auth Proxy IPv6 whitelist bypass
CVE-2026-33380
GR
Grafana
Grafana
6.5
0%
May 13SQL Expressions Read File From Disk
CVE-2026-28380
GR
Grafana
Grafana
6.5
0%
May 13BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
CVE-2026-33381
GR
Grafana
Grafana
8.1
0%
May 13Users can generate Service Account tokens after permissions removal
CVE-2026-33377
GR
Grafana
Grafana
7.1
0%
May 13Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
CVE-2026-28376
GR
Grafana
Grafana
6.5
0%
May 13Grafana Live push endpoint allows unbounded memory allocation leading to OOM
CVE-2026-28379
GR
Grafana
Grafana
6.5
0%
May 13Viewer-triggered race condition in Grafana Live leads to complete server crash
CVE-2026-21728
GR
Grafana
Grafana
7.5
1%
Apr 24Tempo query limit results in unbounded memory allocation
CVE-2026-21726
GR
Grafana
Grafana
5.3
0%
Apr 15Loki Path Traversal - CVE-2021-36156 Bypass
CVE-2025-41118
GR
Grafana
Grafana
9.1
0%
Apr 15Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
CVE-2026-21727
GR
Grafana
Grafana
3.3
0%
Apr 15Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record
CVE-2025-12141
GR
Grafana
Grafana
6.5
0%
Apr 15Grafana Alerting Editors can edit destination of webhooks they did not create
CVE-2026-27879
GR
Grafana
Grafana
6.5
0%
Mar 27Query resampling can cause unbounded memory allocations
CVE-2026-28375
GR
Grafana
Grafana
6.5
0%
Mar 27Grafana Testdata datasource can issue unbounded memory allocations
CVE-2026-27876
GR
Grafana
Grafana
9.1
2%
Mar 27RCE on Grafana via sqlExpressions
CVE-2026-27880
GR
Grafana
Grafana
7.5
1%
Mar 27OpenFeature evaluation API reads input data with no bounds
CVE-2026-27877
GR
Grafana
Grafana
7.5
0%
Mar 27Public dashboards discloses all direct mode datasources
CVE-2026-28377
GR
Grafana
Grafana
7.5
0%
Mar 26S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)