CVE Tools
Track your stack

Grafana Enterprise

40 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Grafana Enterprise, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Grafana Enterprise CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Grafana Enterprise CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-061
2025-070
2025-080
2025-090
2025-100
2025-111
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-061
2026-071
2026-083
2026-098
2026-1012
2026-111

Severity

How the 40 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical25%
  • High1232%
  • Medium2361%
  • Low13%

Latest CVEs

The 15 most recently published vulnerabilities affecting Grafana Enterprise.

  1. CVE-2026-33379Dashboard snapshot permission bypass8.5
  2. CVE-2026-79656OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors6.0
  3. CVE-2026-103506SSO settings authorization bypass—
  4. CVE-2026-88858Server-side expression parser denial of service6.5
  5. CVE-2026-88967Azure Monitor access token disclosure via SSRF7.7
  6. CVE-2026-100105Alerting contact point authorization bypass via schema downgrade7.7
  7. CVE-2026-16491CVE-2026-16491 CVE Record6.5
  8. CVE-2026-92539Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise6.7
  9. CVE-2026-9703Viewer role can create, modify and delete Loki alerting rules7.1
  10. CVE-2026-93294Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs6.3
  11. CVE-2026-95502Git Sync memory exhaustion via a malicious Git server5.3
  12. CVE-2026-33374Unbounded memory allocation in the Prometheus rule conversion API6.5
  13. CVE-2026-15577Git Sync connection configuration can be modified with read-only access6.5
  14. CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API4.3
  15. CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API5.4

Product grouping is registry-driven, with AI assist and human review. How it works