Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how grafana compares to other vendors in security performance

View Risk Score →

Software

grafana grafana
57
grafana labs grafana oss and enterprise
55
grafana labs grafana
14
grafana loki
4
grafana tempo
4
grafana grafana oss
3
grafana synthetic monitoring agent
3
grafana
2
grafana enterprise metrics
2
grafana image renderer
2
grafana oncall
2
grafana piechart-panel
2
grafana alertmanager
1
grafana grafana operator
1
grafana grafana snowflake datasource
1
grafana json api data source grafana
1
grafana labs grafana alerting
1
grafana labs grafana geomap panel
1
grafana labs grafana live
1
grafana labs grafana loki
1
grafana labs grafana mssql data source plugin
1
grafana labs grafana operator
1
grafana labs grafana oss
1
grafana labs grafana testdata datasource
1
grafana labs json datasource plugin
1
grafana loki datasource
1
grafana loki datasource plugin
1
grafana prometheus
1
grafana pyroscope
1
grafana snowflake
1
grafana worldmap panel
1
grafana/grafana
1

Grafana OnCallGrafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Risk 86
Severity
9.3
First published (updated )
CVE-2026-63087

Grafana LokiLoki detected_fields query limits results in unbounded memory allocation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-21729

Grafana GrafanaStored XSS in the table panel (TableNG)

Risk 52
Severity
6.8
First published (updated )
CVE-2026-8595

Grafana GrafanaPre-authentication denial of service via the OAuth login route

Risk 43
Severity
7.5
First published (updated )
CVE-2026-8609

Grafana GrafanaDenial of service via unbounded request body size

Risk 43
Severity
7.5
First published (updated )
CVE-2026-33382
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Grafana GrafanaCross-Organization Public Dashboard Deletion via Missing Org Isolation

Risk 17
Severity
3.1
First published (updated )
CVE-2026-28378

Grafana GrafanaPre-authentication denial of service in the public dashboard query endpoint

Risk 43
Severity
7.5
First published (updated )
CVE-2026-42127

Grafana Grafana Snowflake datasourceLocal File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

Risk 68
Severity
9.6
First published (updated )
CVE-2026-28381

Grafana Labs Grafana Geomap panelStored XSS in the Geomap panel tile-layer attribution

Risk 39
Severity
7.3
EPSS
0.25%
First published (updated )
CVE-2026-9029

Grafana TempoPath traversal in the Tempo and Loki data source plugins

Risk 34
Severity
5.4
First published (updated )
CVE-2026-10601
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Grafana Loki datasource pluginPath traversal in the Loki data source plugin

Risk 44
Severity
7.7
First published (updated )
CVE-2026-42129

Grafana TempoTempo TraceQL query with exemplar hint could result in unbounded memory usage

Risk 38
Severity
6.5
First published (updated )
CVE-2026-27878

Grafana Labs Grafana OperatorOperator - Namespaced User Path Traversal

Risk 79
Severity
6.4
First published (updated )
CVE-2026-11769

Grafana GrafanaIDOR in Annotations API allows unprivileged users to DELETE annotation

Risk 22
Severity
4.3
First published (updated )
CVE-2026-28374

Grafana GrafanaGrafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Risk 38
Severity
6.5
First published (updated )
CVE-2026-33378
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Grafana GrafanaGrafana plugin resources can lead to unbounded memory allocation

Risk 38
Severity
6.5
First published (updated )
CVE-2026-28383

Grafana GrafanaAuth Proxy IPv6 whitelist bypass

Risk 56
Severity
7.4
First published (updated )
CVE-2026-33376

Grafana GrafanaBAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Risk 38
Severity
6.5
First published (updated )
CVE-2026-28380

Grafana GrafanaSQL Expressions Read File From Disk

Risk 38
Severity
6.5
First published (updated )
CVE-2026-33380

Grafana GrafanaUsers can generate Service Account tokens after permissions removal

Risk 60
Severity
8.1
First published (updated )
CVE-2026-33381
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Grafana GrafanaDashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

Risk 48
Severity
7.1
First published (updated )
CVE-2026-33377

Grafana GrafanaGrafana Live push endpoint allows unbounded memory allocation leading to OOM

Risk 38
Severity
6.5
First published (updated )
CVE-2026-28376

Grafana GrafanaViewer-triggered race condition in Grafana Live leads to complete server crash

Risk 38
Severity
6.5
First published (updated )
CVE-2026-28379

Grafana TempoTempo query limit results in unbounded memory allocation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-21728

Grafana Labs Grafana LokiLoki Path Traversal - CVE-2021-36156 Bypass

Risk 27
Severity
5.3
First published (updated )
CVE-2026-21726
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

go/github.com/grafana/pyroscopeSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Risk 66
Severity
9.1
First published (updated )
CVE-2025-41118

Grafana GrafanaGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record

Risk 23
Severity
3.3
First published (updated )
CVE-2026-21727

Grafana Labs Grafana AlertingGrafana Alerting Editors can edit destination of webhooks they did not create

Risk 38
Severity
1.3
First published (updated )
CVE-2025-12141

Grafana GrafanaQuery resampling can cause unbounded memory allocations

Risk 38
Severity
6.5
First published (updated )
CVE-2026-27879

Grafana GrafanaGrafana Testdata datasource can issue unbounded memory allocations

Risk 38
Severity
6.5
First published (updated )
CVE-2026-28375
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203