GR
Monitoring
Grafana
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
9.9
Max CVSS
13
New 30D
Severity mix
Critical 11High 61Medium 89Low 10
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-15043 | 7.5 | Sep 3 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use Affected: 2.0.0 before 5.4.5; 6.0.0 before 6.3.4 |
| CVE-2026-33376 | 7.4 | May 13 | Auth Proxy IPv6 whitelist bypass Affected: 9.4.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-76154 | 7.3 | Sep 17 | CVE-2026-76154 CVE Record Affected: 12.3.0; 12.4.0 through 12.4.10; 13.0.0 through 13.0.8; 13.1.0 through 13.1.5; 13.2.0 through 13.2.1 |
| CVE-2023-4399 | 7.2 | Oct 17 | Grafana is an open-source platform for monitoring and observability Affected: 10.1.0 before 10.1.5; 10.0.0 before 10.0.9; 9.5.0 before 9.5.13; 9.4.0 before 9.4.17 |
| CVE-2023-4822 | 7.2 | Oct 16 | Grafana is an open-source platform for monitoring and observability Affected: 8.0.0 before 9.4.16; 9.5.0 before 9.5.11; 10.0.0 before 10.0.7; 10.1.0 before 10.1.3 |
| CVE-2021-41244 | 7.2 | Nov 15 | Cross organization admin control in Grafana Affected: >= 8.0.0, < 8.2.4 |
| CVE-2026-9703 | 7.1 | Oct 15 | Viewer role can create, modify and delete Loki alerting rules Affected: 12.3.0 through 12.3.8; 12.4.0 through 12.4.5; 8.0.0 through 12.3.0; 13.0.0 through 13.0.3 |
| CVE-2026-17183 | 7.1 | Aug 19 | CVE-2026-17183 CVE Record Affected: 8.4.0 before 12.3.11; 12.4.0 before 12.4.9; 13.0.0 before 13.0.7; 13.1.0 before 13.1.4 |
| CVE-2026-9765 | 7.1 | Jul 24 | CVE-2026-9765 CVE Record Affected: 1.0.0 through 1.164.0 |
| CVE-2026-33377 | 7.1 | May 13 | Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin Affected: 8.5.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2021-27962 | 7.1 | Mar 22 | Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to… Affected: 7.2.0 before 7.3.10; 7.4.0 before 7.4.5 |