| CVE-2026-79656 |
OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
|
6.0
Moyenne
|
28 oct. 2026 |
| CVE-2026-103506 |
SSO settings authorization bypass
|
8.9
Élevée
|
28 oct. 2026 |
| CVE-2026-88858 |
Server-side expression parser denial of service
|
6.5
Moyenne
|
28 oct. 2026 |
| CVE-2026-88967 |
Azure Monitor access token disclosure via SSRF
|
7.7
Élevée
|
28 oct. 2026 |
| CVE-2026-100105 |
Alerting contact point authorization bypass via schema downgrade
|
7.7
Élevée
|
28 oct. 2026 |
| CVE-2026-16491 |
CVE-2026-16491 CVE Record
|
6.5
Moyenne
|
27 oct. 2026 |
| CVE-2026-92539 |
A service account with user-management permissions in one organization can read, modify, disable or delete users…
|
6.7
Moyenne
|
20 oct. 2026 |
| CVE-2026-9703 |
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources
|
7.1
Élevée
|
15 oct. 2026 |
| CVE-2026-93294 |
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager…
|
6.3
Moyenne
|
13 oct. 2026 |
| CVE-2026-95502 |
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning…
|
5.3
Moyenne
|
13 oct. 2026 |
| CVE-2026-15577 |
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's…
|
6.5
Moyenne
|
13 oct. 2026 |
| CVE-2026-33374 |
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users…
|
6.5
Moyenne
|
13 oct. 2026 |
| CVE-2026-13719 |
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API…
|
4.3
Moyenne
|
30 sept. 2026 |
| CVE-2026-13720 |
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and…
|
5.4
Moyenne
|
30 sept. 2026 |
| CVE-2026-81842 |
An authenticated user with edit permission on one folder can move a library panel into another folder where they only…
|
4.3
Moyenne
|
29 sept. 2026 |
| CVE-2026-81841 |
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data
|
5.3
Moyenne
|
29 sept. 2026 |
| CVE-2026-15815 |
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives
|
8.8
Élevée
|
17 sept. 2026 |
| CVE-2026-76154 |
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role…
|
7.3
Élevée
|
17 sept. 2026 |
| CVE-2026-14199 |
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than…
|
7.1
Élevée
|
2 sept. 2026 |
| CVE-2026-12704 |
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo…
|
6.8
Moyenne
|
2 sept. 2026 |
| CVE-2026-19197 |
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on…
|
6.3
Moyenne
|
26 août 2026 |
| CVE-2026-17183 |
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking…
|
7.1
Élevée
|
19 août 2026 |
| CVE-2026-11817 |
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments…
|
5.3
Moyenne
|
17 août 2026 |
| CVE-2026-28378 |
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one…
|
3.1
Faible
|
7 juil. 2026 |
| CVE-2026-42127 |
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated…
|
7.5
Élevée
|
22 juin 2026 |