| CVE-2026-79656 |
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
|
6.0
Medium
|
Oct 28, 2026 |
| CVE-2026-103506 |
SSO settings authorization bypass
|
8.9
High
|
Oct 28, 2026 |
| CVE-2026-88858 |
Server-side expression parser denial of service
|
6.5
Medium
|
Oct 28, 2026 |
| CVE-2026-88967 |
Azure Monitor access token disclosure via SSRF
|
7.7
High
|
Oct 28, 2026 |
| CVE-2026-100105 |
Alerting contact point authorization bypass via schema downgrade
|
7.7
High
|
Oct 28, 2026 |
| CVE-2026-16491 |
CVE-2026-16491 CVE Record
|
6.5
Medium
|
Oct 27, 2026 |
| CVE-2026-92539 |
A service account with user-management permissions in one organization can read, modify, disable or delete users…
|
6.7
Medium
|
Oct 20, 2026 |
| CVE-2026-9703 |
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources
|
7.1
High
|
Oct 15, 2026 |
| CVE-2026-93294 |
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager…
|
6.3
Medium
|
Oct 13, 2026 |
| CVE-2026-95502 |
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning…
|
5.3
Medium
|
Oct 13, 2026 |
| CVE-2026-15577 |
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's…
|
6.5
Medium
|
Oct 13, 2026 |
| CVE-2026-33374 |
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users…
|
6.5
Medium
|
Oct 13, 2026 |
| CVE-2026-13719 |
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API…
|
4.3
Medium
|
Sep 30, 2026 |
| CVE-2026-13720 |
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and…
|
5.4
Medium
|
Sep 30, 2026 |
| CVE-2026-81842 |
An authenticated user with edit permission on one folder can move a library panel into another folder where they only…
|
4.3
Medium
|
Sep 29, 2026 |
| CVE-2026-81841 |
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data
|
5.3
Medium
|
Sep 29, 2026 |
| CVE-2026-15815 |
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives
|
8.8
High
|
Sep 17, 2026 |
| CVE-2026-76154 |
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role…
|
7.3
High
|
Sep 17, 2026 |
| CVE-2026-14199 |
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than…
|
7.1
High
|
Sep 2, 2026 |
| CVE-2026-12704 |
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo…
|
6.8
Medium
|
Sep 2, 2026 |
| CVE-2026-19197 |
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on…
|
6.3
Medium
|
Aug 26, 2026 |
| CVE-2026-17183 |
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking…
|
7.1
High
|
Aug 19, 2026 |
| CVE-2026-11817 |
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments…
|
5.3
Medium
|
Aug 17, 2026 |
| CVE-2026-28378 |
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one…
|
3.1
Low
|
Jul 7, 2026 |
| CVE-2026-42127 |
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated…
|
7.5
High
|
Jun 22, 2026 |