| CVE-2026-8609 |
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory…
|
5.3
Moyenne
|
10 juil. 2026 |
| CVE-2026-33382 |
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing…
|
7.5
Élevée
|
10 juil. 2026 |
| CVE-2026-28378 |
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one…
|
3.1
Faible
|
7 juil. 2026 |
| CVE-2026-42127 |
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated…
|
7.5
Élevée
|
22 juin 2026 |
| CVE-2026-9029 |
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile…
|
7.3
Élevée
|
22 juin 2026 |
| CVE-2026-10601 |
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach…
|
5.4
Moyenne
|
22 juin 2026 |
| CVE-2026-42129 |
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki…
|
7.7
Élevée
|
22 juin 2026 |
| CVE-2026-28374 |
Editors could delete any annotation, even those they do not have read access to
|
4.3
Moyenne
|
13 mai 2026 |
| CVE-2026-33378 |
Using the $__timeGroup macro, one can achieve an OOM by overloading the server
|
6.5
Moyenne
|
13 mai 2026 |
| CVE-2026-28383 |
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request…
|
6.5
Moyenne
|
13 mai 2026 |
| CVE-2026-33376 |
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses
|
7.4
Élevée
|
13 mai 2026 |
| CVE-2026-28380 |
Any Editor could delete any snapshot, even if they have no access to read or write them
|
6.5
Moyenne
|
13 mai 2026 |
| CVE-2026-33380 |
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's…
|
6.3
Moyenne
|
13 mai 2026 |
| CVE-2026-33381 |
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a…
|
5.9
Moyenne
|
13 mai 2026 |
| CVE-2026-33377 |
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard
|
7.1
Élevée
|
13 mai 2026 |
| CVE-2026-28376 |
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming…
|
6.5
Moyenne
|
13 mai 2026 |
| CVE-2026-28379 |
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending…
|
6.5
Moyenne
|
13 mai 2026 |
| CVE-2026-21724 |
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points…
|
5.4
Moyenne
|
26 mars 2026 |
| CVE-2026-33375 |
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API…
|
6.5
Moyenne
|
26 mars 2026 |