Grafana Grafana OSS

• CVE-2026-79656 Medium 6.0 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 0.2%
• CVE-2026-103506 High 8.9 SSO settings authorization bypass 0.3%
• CVE-2026-88858 Medium 6.5 Server-side expression parser denial of service 0.3%
• CVE-2026-88967 High 7.7 Azure Monitor access token disclosure via SSRF 0.3%
• CVE-2026-100105 High 7.7 Alerting contact point authorization bypass via schema downgrade 0.3%
• CVE-2026-16491 Medium 6.5 CVE-2026-16491 CVE Record 0.3%
• CVE-2026-9703 High 7.1 Viewer role can create, modify and delete Loki alerting rules 0.2%
• CVE-2026-33374 Medium 6.5 Unbounded memory allocation in the Prometheus rule conversion API 0.4%
• CVE-2026-15577 Medium 6.5 Git Sync connection configuration can be modified with read-only access 0.3%
• CVE-2026-93294 Medium 6.3 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs 0.3%
• CVE-2026-95502 Medium 5.3 Git Sync memory exhaustion via a malicious Git server 0.4%
• CVE-2026-13720 Medium 5.4 Editor can forge file-provisioning provenance on dashboards via the dashboard API 0.2%
• CVE-2026-13719 Medium 4.3 Alert rules in restricted folders disclosed via the alert rules list API 0.2%
• CVE-2026-81842 Medium 4.3 Library panel can be moved into a folder without library panel create permission 0.2%
• CVE-2026-81841 Medium 5.3 Paused shared dashboard access tokens still expose data source configuration 0.4%
• CVE-2026-15815 High 8.8 CVE-2026-15815 CVE Record 0.7%
• CVE-2026-76154 High 7.3 CVE-2026-76154 CVE Record 0.4%
• CVE-2026-14199 High 7.1 Session takeover via Auth Proxy cache key collision 0.3%
• CVE-2026-19475 Medium 6.5 SQL Data Source Plugin: OOM DoS via $__timeGroup macro 0.4%
• CVE-2026-19197 Medium 6.3 Broken access control in dashboard snapshots 0.2%
• CVE-2026-17033 Medium 6.8 CVE-2026-17033 CVE Record 0.2%
• CVE-2026-17183 High 7.1 CVE-2026-17183 CVE Record 0.3%
• CVE-2026-11817 Medium 5.3 CVE-2026-11817 CVE Record 0.4%
• CVE-2026-21723 Medium 5.3 CVE-2026-21723 Record 0.2%
• CVE-2026-8595 Medium 6.8 Stored XSS in the table panel (TableNG) 0.2%
• CVE-2026-8609 Medium 5.3 Pre-authentication denial of service via the OAuth login route 0.4%
• CVE-2026-33382 High 7.5 Denial of service via unbounded request body size 0.4%
• CVE-2026-28378 Low 3.1 Cross-Organization Public Dashboard Deletion via Missing Org Isolation 0.2%
• CVE-2026-42127 High 7.5 Pre-authentication denial of service in the public dashboard query endpoint 0.4%
• CVE-2026-9029 High 7.3 Stored XSS in the Geomap panel tile-layer attribution 0.3%
• CVE-2026-10601 Medium 5.4 Path traversal in the Tempo and Loki data source plugins 0.3%
• CVE-2026-42129 High 7.7 Path traversal in the Loki data source plugin 0.4%
• CVE-2026-28374 Medium 4.3 IDOR in Annotations API allows unprivileged users to DELETE annotation 0.2%
• CVE-2026-33378 Medium 6.5 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 0.3%
• CVE-2026-28383 Medium 6.5 Grafana plugin resources can lead to unbounded memory allocation 0.3%
• CVE-2026-33376 High 7.4 Auth Proxy IPv6 whitelist bypass 0.3%
• CVE-2026-33380 Medium 6.3 SQL Expressions Read File From Disk 0.4%
• CVE-2026-28380 Medium 6.5 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 0.2%
• CVE-2026-33381 Medium 5.9 Users can generate Service Account tokens after permissions removal 0.3%
• CVE-2026-33377 High 7.1 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 0.2%
• CVE-2026-28376 Medium 6.5 Grafana Live push endpoint allows unbounded memory allocation leading to OOM 0.3%
• CVE-2026-28379 Medium 6.5 Viewer-triggered race condition in Grafana Live leads to complete server crash 0.3%
• CVE-2026-21724 Medium 5.4 Missing Protected-field Authorization in Provisioning Contact Points API 0.3%
• CVE-2026-33375 Medium 6.5 Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS 0.5%