GR
Monitoring
Grafana
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
9.9
Max CVSS
13
New 30D
Severity mix
Critical 11High 61Medium 89Low 10
Watch
Add Grafana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-28374 | 4.3 | May 13 | IDOR in Annotations API allows unprivileged users to DELETE annotation Affected: 8.5.0 through 11.6.14; 11.6.14 before 11.6.14+security-04; 12.0.0 through 12.2.8; 12.2.8 before 12.2.8+security-04; 12.3.0 through 12.3.6; 12.3.6 before 12.3.6+security-04; +4 more |
| CVE-2026-21724 | 4.3 | Mar 26 | Missing Protected-field Authorization in Provisioning Contact Points API Affected: 12.3.1 before 12.3.6; 12.2.2 before 12.2.8; 12.1.5 before 12.1.10; 11.6.9 before 11.6.14 |
| CVE-2025-10630 | 4.3 | Sep 19 | Regex DoS in Grafana Zabbix Plugin Affected: before 6.0.2 |
| CVE-2025-3415 | 4.3 | Jul 17 | Grafana is an open-source platform for monitoring and observability Affected: 10.4.x before 10.4.19+security-01; 11.2.x before 11.2.10+security-01; 11.3.x before 11.3.7+security-01; 11.4.x before 11.4.5+security-01; 11.5.x before 11.5.5+security-01; 11.6.x before 11.6.2+security-01; +1 more |
| CVE-2024-11741 | 4.3 | Jan 31 | Grafana is an open-source platform for monitoring and observability Affected: 11.4.0 before 11.4.1; 11.3.0 before 11.3.3; 11.2.0 before 11.2.6; 11.1.0 before 11.1.11; 10.4.0 before 10.4.15 |
| CVE-2022-39229 | 4.3 | Oct 13 | Grafana users with email as a username can block other users from signing in Affected: >= 9.0.0, < 9.1.8; >= 8.5.0, < 8.5.14 |
| CVE-2022-21713 | 4.3 | Feb 8 | Exposure of Sensitive Information in Grafana Affected: >= 5.0.0-beta1, < 7.5.15; >= 8.0.0, < 8.3.5 |
| CVE-2022-21673 | 4.3 | Jan 18 | OAuth Identity Token exposure in Grafana Affected: >= 7.2.0, < 7.5.13; >= 8.0.0, < 8.3.4 |
| CVE-2021-43815 | 4.3 | Dec 10 | Grafana directory traversal for `.cvs` files Affected: >= 8.0.0-beta3, < 8.3.2; >= 5.0.0, < 7.5.12 |
| CVE-2021-43813 | 4.3 | Dec 10 | Directory Traversal in Grafana Affected: >= 5.0.0, < 7.5.12; >= 8.0.0, < 8.3.2 |
| CVE-2025-6197 | 4.2 | Jul 18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality Affected: 12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 |
| CVE-2022-36062 | 3.8 | Sep 22 | Grafana folders admin only permission privilege escalation Affected: < 8.5.13; >= 9.0.0, < 9.0.9; >= 9.1.0, < 9.1.6 |
| CVE-2022-39324 | 3.5 | Jan 27 | Grafana vulnerable to spoofing originalUrl of snapshots Affected: < 8.5.16; >= 9.0.0, < 9.2.8 |
| CVE-2026-21727 | 3.3 | Apr 15 | Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record Affected: 10.2.0 before 12.4.0 |
| CVE-2022-46156 | 3.3 | Nov 30 | Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information Affected: < 0.12.0 |
| CVE-2026-28378 | 2.7 | Jul 7 | Cross-Organization Public Dashboard Deletion via Missing Org Isolation Affected: 11.6.0 through 11.6.13; 12.1.0 through 12.1.9; 12.2.0 through 12.2.7; 12.3.0 through 12.3.5; 12.4.0 through 12.4.1 |
| CVE-2025-1088 | 2.7 | Jun 18 | Very long unicode dashboard title or panel name can hang the frontend Affected: before 11.6.2 |
| CVE-2024-10452 | 2.7 | Oct 29 | Organization admins can delete pending invites created in an organization they are not part of Affected: 10.4.0 |
| CVE-2025-41116 | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Databricks Datasource Affected: 1.6.0 before 1.12.1 |
| CVE-2025-3717 | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Snowflake Datasource Affected: 1.5.0 before 1.14.1 |
| CVE-2026-21725 | 2.0 | Feb 25 | Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name Affected: v11.0.0 before v12.4.1 |