Grafana

21 CVEs tracked in the last 90 days

21 Total CVEs

3 Critical

7 High

9 Medium

2 Low

Severity Distribution

Critical 3 (14.3%)

High 7 (33.3%)

Medium 9 (42.9%)

Low 2 (9.5%)

Top Affected Products

grafana grafana 5

Grafana grafana/grafana 4

Grafana grafana/grafana-enterprise 4

Grafana Grafana 3

Grafana Tempo 2

Grafana Grafana OSS 2

Grafana Loki 1

Grafana Pyroscope 1

CVSS Score Distribution

Latest CVEs

CVE ID	Severity	CVSS	Description	Published	Modified
CVE-2026-21728	high	7.5	Tempo queries with large limits can cause large memory allocations which can impact the availability…	Apr 24, 2026	Apr 24, 2026
CVE-2026-21726	medium	5.3	The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single…	Apr 15, 2026	Apr 24, 2026
CVE-2025-41118	critical	9.1	Pyroscope is an open-source continuous profiling database. The database supports various storage bac…	Apr 15, 2026	Apr 24, 2026
CVE-2026-21727	low	3.3	--- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /stat…	Apr 15, 2026	Apr 24, 2026
CVE-2025-12141	medium	6.5	In Grafana's alerting system, users with edit permissions for a contact point, specifically the perm…	Apr 15, 2026	Apr 20, 2026
CVE-2026-27880	high	7.5	The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cau…	Mar 27, 2026	May 10, 2026
CVE-2026-27877	medium	6.5	When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed…	Mar 27, 2026	May 10, 2026
CVE-2026-27879	medium	6.5	A resample query can be used to trigger out-of-memory crashes in Grafana.	Mar 27, 2026	Apr 24, 2026
CVE-2026-28375	medium	6.5	A testdata data-source can be used to trigger out-of-memory crashes in Grafana.	Mar 27, 2026	Apr 24, 2026
CVE-2026-27876	critical	9.1	A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary …	Mar 27, 2026	Apr 24, 2026
CVE-2026-28377	high	7.5	A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /statu…	Mar 26, 2026	Apr 24, 2026
CVE-2026-21724	medium	5.4	A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning…	Mar 26, 2026	Apr 24, 2026
CVE-2026-33375	medium	6.5	The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer…	Mar 26, 2026	Apr 24, 2026
CVE-2026-32117	high	7.6	The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's…	Mar 11, 2026	Mar 12, 2026
CVE-2026-21725	low	2.6	A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sou…	Feb 25, 2026	May 10, 2026
CVE-2025-41117	medium	6.8	Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious…	Feb 12, 2026	Apr 24, 2026
CVE-2026-21722	medium	5.3	Public dashboards with annotations enabled did not limit their annotation timerange to the locked ti…	Feb 12, 2026	Apr 24, 2026
CVE-2026-21721	high	8.1	The dashboard permissions API does not verify the target dashboard scope and only checks the dashboa…	Jan 27, 2026	Apr 24, 2026
CVE-2026-21720	high	7.5	Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the re…	Jan 27, 2026	Apr 24, 2026
CVE-2025-41115	critical	10.0	SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how org…	Nov 21, 2025	Apr 24, 2026
CVE-2025-4123	high	7.6	A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path trave…	May 22, 2025	Apr 29, 2026