g
grafana
Security Risk Profile
43
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 154 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 8, 2018 to present
154
Total CVEs
74
Critical+High
4
Exploited
34
Unpatched
Threat Assessment
Avg CVSS
6.7
Base severity
Avg EPSS
2%
Exploit probability
Unpatched
34
Critical/High
Risk Level
43/100
medium
⚠️ 4 Active Exploits⚡ 1 Zero-Days📈 5 in Last 30 Days
Severity Distribution
Critical
16High
58Medium
71Low
7Exploit Likelihood
>50% chance
020-50%
05-20%
1<5%
10Age Distribution
Common Weaknesses (CWE)
1
XSS
29
2
Infoleak
16
3
Path Traversal
14
4
SSRF
4
5
Race Condition
3
Most Affected Products
1. Grafana Grafana425
2. redhat/grafana98
3. go/github.com/grafana/grafana90
4. redhat/Grafana16
5. Fedoraproject Fedora15
Recent Vulnerabilities
See more →CVE-2026-14199
CVSS 7.1high
Session takeover via Auth Proxy cache key collision
Sep 2, 2026🔧 No Patch
CVE-2026-19475
CVSS 6.5medium
SQL Data Source Plugin: OOM DoS via $__timeGroup macro
Sep 2, 2026🔧 No Patch
CVE-2026-75889
CVSS 7.7high
CVE Record
Aug 27, 2026🔧 No Patch
CVE-2026-19197
CVSS 6.3medium
Broken access control in dashboard snapshots
Aug 26, 2026🔧 No Patch
CVE-2026-11817
CVSS 5.3medium
CVE Record
Aug 17, 2026🔧 No Patch
CVE-2026-63087
CVSS 9.3critical
Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
Jul 16, 2026🔧 No Patch
CVE-2026-21729
CVSS 7.5high
Loki detected_fields query limits results in unbounded memory allocation
Jul 16, 2026🔧 No Patch
REDHAT-BUG-2499062
CVSS 4.0medium
Jul 10, 2026🔧 No Patch
CVE-2026-8595
CVSS 6.8medium
Stored XSS in the table panel (TableNG)
Jul 10, 2026🔧 No Patch
CVE-2026-8609
CVSS 7.5high
Pre-authentication denial of service via the OAuth login route
Jul 10, 2026🔧 No Patch
Monitor grafana in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.