| CVE-2026-79656 |
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
|
6.0
Medium
|
Oct 28, 2026 |
| CVE-2026-103506 |
SSO settings authorization bypass
|
8.9
High
|
Oct 28, 2026 |
| CVE-2026-88858 |
Server-side expression parser denial of service
|
6.5
Medium
|
Oct 28, 2026 |
| CVE-2026-88967 |
Azure Monitor access token disclosure via SSRF
|
7.7
High
|
Oct 28, 2026 |
| CVE-2026-100105 |
Alerting contact point authorization bypass via schema downgrade
|
7.7
High
|
Oct 28, 2026 |
| CVE-2026-16491 |
CVE-2026-16491 CVE Record
|
6.5
Medium
|
Oct 27, 2026 |
| CVE-2026-9703 |
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources
|
7.1
High
|
Oct 15, 2026 |
| CVE-2026-93294 |
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager…
|
6.3
Medium
|
Oct 13, 2026 |
| CVE-2026-95502 |
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning…
|
5.3
Medium
|
Oct 13, 2026 |
| CVE-2026-15577 |
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's…
|
6.5
Medium
|
Oct 13, 2026 |
| CVE-2026-33374 |
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users…
|
6.5
Medium
|
Oct 13, 2026 |
| CVE-2026-13719 |
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API…
|
4.3
Medium
|
Sep 30, 2026 |
| CVE-2026-13720 |
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and…
|
5.4
Medium
|
Sep 30, 2026 |
| CVE-2026-81842 |
An authenticated user with edit permission on one folder can move a library panel into another folder where they only…
|
4.3
Medium
|
Sep 29, 2026 |
| CVE-2026-81841 |
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data
|
5.3
Medium
|
Sep 29, 2026 |
| CVE-2026-15815 |
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives
|
8.8
High
|
Sep 17, 2026 |
| CVE-2026-76154 |
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role…
|
7.3
High
|
Sep 17, 2026 |
| CVE-2026-14199 |
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than…
|
7.1
High
|
Sep 2, 2026 |
| CVE-2026-19475 |
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting…
|
6.5
Medium
|
Sep 2, 2026 |
| CVE-2026-19197 |
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on…
|
6.3
Medium
|
Aug 26, 2026 |
| CVE-2026-17033 |
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert…
|
6.8
Medium
|
Aug 24, 2026 |
| CVE-2026-17183 |
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking…
|
7.1
High
|
Aug 19, 2026 |
| CVE-2026-11817 |
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments…
|
5.3
Medium
|
Aug 17, 2026 |
| CVE-2026-21723 |
The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute…
|
5.3
Medium
|
Jul 23, 2026 |
| CVE-2026-8595 |
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that…
|
6.8
Medium
|
Jul 10, 2026 |