CVE Tools
Track your stack

Grafana Oss

45 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Grafana Oss, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Grafana Oss CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Grafana Oss CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-032
2026-040
2026-0510
2026-064
2026-075
2026-084
2026-098
2026-1011
2026-111

Severity

How the 45 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High1433%
  • Medium2865%
  • Low12%

Latest CVEs

The 15 most recently published vulnerabilities affecting Grafana Oss.

  1. CVE-2026-33379Dashboard snapshot permission bypass8.5
  2. CVE-2026-79656OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors6.0
  3. CVE-2026-103506SSO settings authorization bypass—
  4. CVE-2026-88858Server-side expression parser denial of service6.5
  5. CVE-2026-88967Azure Monitor access token disclosure via SSRF7.7
  6. CVE-2026-100105Alerting contact point authorization bypass via schema downgrade7.7
  7. CVE-2026-16491CVE-2026-16491 CVE Record6.5
  8. CVE-2026-9703Viewer role can create, modify and delete Loki alerting rules7.1
  9. CVE-2026-93294Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs6.3
  10. CVE-2026-95502Git Sync memory exhaustion via a malicious Git server5.3
  11. CVE-2026-33374Unbounded memory allocation in the Prometheus rule conversion API6.5
  12. CVE-2026-15577Git Sync connection configuration can be modified with read-only access6.5
  13. CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API4.3
  14. CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API5.4
  15. CVE-2026-81842Library panel can be moved into a folder without library panel create permission4.3

Product grouping is registry-driven, with AI assist and human review. How it works