Product by Grafana
Grafana Oss
44 known vulnerabilities in Grafana Oss (Grafana), 0 of them actively exploited (CISA KEV).
Key figures
44
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-15815 | Grafana OSS: Link Following | 8.8 | |
| High | CVE-2026-103506 | SSO settings authorization bypass | — | |
| High | CVE-2026-76154 | Grafana OSS: Cross-site Scripting | 7.3 | |
| Medium | CVE-2026-19475 | SQL Data Source Plugin: OOM DoS via $__timeGroup macro | 6.5 | |
| Medium | CVE-2026-33374 | Unbounded memory allocation in the Prometheus rule conversion API | 6.5 | |
| High | CVE-2026-42129 | Path traversal in the Loki data source plugin | 7.7 | |
| High | CVE-2026-17183 | Grafana OSS: Incorrect Authorization | 7.1 | |
| High | CVE-2026-88967 | Azure Monitor access token disclosure via SSRF | 7.7 | |
| High | CVE-2026-100105 | Alerting contact point authorization bypass via schema downgrade | 7.7 | |
| High | CVE-2026-42127 | Pre-authentication denial of service in the public dashboard query endpoint | 7.5 | |
| High | CVE-2026-8609 | Pre-authentication denial of service via the OAuth login route | 7.5 | |
| High | CVE-2026-33382 | Denial of service via unbounded request body size | 7.5 | |
| High | CVE-2026-14199 | Session takeover via Auth Proxy cache key collision | 7.1 | |
| High | CVE-2026-9703 | Viewer role can create, modify and delete Loki alerting rules | 7.1 | |
| Medium | CVE-2026-15577 | Git Sync connection configuration can be modified with read-only access | 6.5 | |
| Medium | CVE-2026-17033 | Grafana OSS: Cross-site Scripting | 6.8 | |
| Medium | CVE-2026-81841 | Paused shared dashboard access tokens still expose data source configuration | 5.3 | |
| Medium | CVE-2026-93294 | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | 6.3 | |
| Medium | CVE-2026-95502 | Git Sync memory exhaustion via a malicious Git server | 5.3 | |
| High | CVE-2026-33381 | Users can generate Service Account tokens after permissions removal | 8.1 | |
| Medium | CVE-2026-88858 | Server-side expression parser denial of service | 6.5 | |
| Medium | CVE-2026-16491 | Grafana Enterprise: Missing Authorization | 6.5 | |
| Medium | CVE-2026-19197 | Broken access control in dashboard snapshots | 6.3 | |
| Medium | CVE-2026-33375 | Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS | 6.5 | |
| Medium | CVE-2026-79656 | Grafana OSS: Insertion of Sensitive Information into Log File | 6.0 |