Grafana

Products

Exploited and recent CVEs

• CVE-2021-43798 High 7.5 Exploited Grafana path traversal 88.5%
• CVE-2021-39226 Critical 9.8 Exploited Snapshot authentication bypass in grafana 99.9%
• CVE-2026-81938 High 7.7 Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir 0.4%
• CVE-2026-81938 High 7.7 Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir 0.4%
• CVE-2026-79656 Medium 6.0 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 0.2%
• CVE-2026-79656 Medium 6.0 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 0.2%
• CVE-2026-103506 High 8.9 SSO settings authorization bypass 0.3%
• CVE-2026-103506 High 8.9 SSO settings authorization bypass 0.3%
• CVE-2026-88858 Medium 6.5 Server-side expression parser denial of service 0.3%
• CVE-2026-88858 Medium 6.5 Server-side expression parser denial of service 0.3%
• CVE-2026-88967 High 7.7 Azure Monitor access token disclosure via SSRF 0.3%
• CVE-2026-88967 High 7.7 Azure Monitor access token disclosure via SSRF 0.3%
• CVE-2026-100105 High 7.7 Alerting contact point authorization bypass via schema downgrade 0.3%
• CVE-2026-100105 High 7.7 Alerting contact point authorization bypass via schema downgrade 0.3%
• CVE-2026-16491 Medium 6.5 CVE-2026-16491 CVE Record 0.3%
• CVE-2026-16491 Medium 6.5 CVE-2026-16491 CVE Record 0.3%
• CVE-2026-92539 Medium 6.7 Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise 0.3%
• CVE-2026-9703 High 7.1 Viewer role can create, modify and delete Loki alerting rules 0.2%
• CVE-2026-9703 High 7.1 Viewer role can create, modify and delete Loki alerting rules 0.2%
• CVE-2026-33374 Medium 6.5 Unbounded memory allocation in the Prometheus rule conversion API 0.4%
• CVE-2026-33374 Medium 6.5 Unbounded memory allocation in the Prometheus rule conversion API 0.4%
• CVE-2026-15577 Medium 6.5 Git Sync connection configuration can be modified with read-only access 0.3%
• CVE-2026-15577 Medium 6.5 Git Sync connection configuration can be modified with read-only access 0.3%
• CVE-2026-93294 Medium 6.3 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs 0.3%
• CVE-2026-93294 Medium 6.3 Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs 0.3%
• CVE-2026-95502 Medium 5.3 Git Sync memory exhaustion via a malicious Git server 0.4%
• CVE-2026-95502 Medium 5.3 Git Sync memory exhaustion via a malicious Git server 0.4%
• CVE-2026-95502 Medium 5.3 Git Sync memory exhaustion via a malicious Git server 0.4%
• CVE-2026-89039 Medium 6.5 Arbitrary file read via the convert_playwright_script prompt in mcp-k6 0.4%
• CVE-2026-13720 Medium 5.4 Editor can forge file-provisioning provenance on dashboards via the dashboard API 0.2%