Product by Grafana
Grafana Enterprise
39 known vulnerabilities in Grafana Enterprise (Grafana), 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-41115 | Incorrect privilege assignment | 10.0 | |
| Medium | CVE-2025-2703 | Grafana: Cross-site Scripting | 6.8 | |
| Critical | CVE-2023-3128 | Grafana: Authentication Bypass by Spoofing | 9.4 | |
| High | CVE-2023-0507 | Grafana: Cross-site Scripting | 7.3 | |
| High | CVE-2023-0594 | Grafana: Cross-site Scripting | 7.3 | |
| High | CVE-2026-15815 | Grafana OSS: Link Following | 8.8 | |
| High | CVE-2026-103506 | SSO settings authorization bypass | — | |
| High | CVE-2023-4399 | Grafana Enterprise: Permissive List of Allowed Inputs | 6.6 | |
| High | CVE-2023-4822 | Grafana Enterprise: Improper Privilege Management | 6.7 | |
| High | CVE-2026-76154 | Grafana OSS: Cross-site Scripting | 7.3 | |
| Medium | CVE-2023-6152 | Grafana: Incorrect Authorization | 5.4 | |
| High | CVE-2026-88967 | Azure Monitor access token disclosure via SSRF | 7.7 | |
| High | CVE-2026-100105 | Alerting contact point authorization bypass via schema downgrade | 7.7 | |
| Medium | CVE-2026-33374 | Unbounded memory allocation in the Prometheus rule conversion API | 6.5 | |
| Medium | CVE-2026-92539 | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | 6.7 | |
| High | CVE-2026-17183 | Grafana OSS: Incorrect Authorization | 7.1 | |
| Medium | CVE-2026-88858 | Server-side expression parser denial of service | 6.5 | |
| High | CVE-2026-42127 | Pre-authentication denial of service in the public dashboard query endpoint | 7.5 | |
| High | CVE-2023-1387 | Grafana: Exposure of Sensitive Information to an Unauthorized Actor | 4.2 | |
| Medium | CVE-2026-16491 | Grafana Enterprise: Missing Authorization | 6.5 | |
| High | CVE-2026-9703 | Viewer role can create, modify and delete Loki alerting rules | 7.1 | |
| High | CVE-2026-14199 | Session takeover via Auth Proxy cache key collision | 7.1 | |
| Medium | CVE-2026-15577 | Git Sync connection configuration can be modified with read-only access | 6.5 | |
| Medium | CVE-2026-81841 | Paused shared dashboard access tokens still expose data source configuration | 5.3 | |
| Medium | CVE-2026-93294 | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | 6.3 |