Grafana

This hub aggregates every CVE we track for Grafana, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Grafana.

• CVE-2026-14199Session takeover via Auth Proxy cache key collision7.1Sep 2, 2026
• CVE-2026-8595Stored XSS in the table panel (TableNG)6.8Jul 10, 2026
• CVE-2026-8609Pre-authentication denial of service via the OAuth login route5.3Jul 10, 2026
• CVE-2026-33382Denial of service via unbounded request body size7.5Jul 10, 2026
• CVE-2026-28378Cross-Organization Public Dashboard Deletion via Missing Org Isolation3.1Jul 7, 2026
• CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpoint7.5Jun 22, 2026
• CVE-2026-9029Stored XSS in the Geomap panel tile-layer attribution7.3Jun 22, 2026
• CVE-2026-10601Path traversal in the Tempo and Loki data source plugins5.4Jun 22, 2026
• CVE-2026-28374IDOR in Annotations API allows unprivileged users to DELETE annotation4.3May 13, 2026
• CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro6.5May 13, 2026
• CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocation6.5May 13, 2026
• CVE-2026-33376Auth Proxy IPv6 whitelist bypass7.4May 13, 2026
• CVE-2026-28380BAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5May 13, 2026
• CVE-2026-33380SQL Expressions Read File From Disk6.3May 13, 2026
• CVE-2026-33381Users can generate Service Account tokens after permissions removal5.9May 13, 2026