Grafana

8 CVEs published in the last four months. Exploited flaws first.

Critical1

High7

Medium0

Exploited (KEV)0

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-28381	9.6	critical	snowflake	The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against	75d ago
CVE-2026-11769	8.8	high	grafana operator	We have released version 5.24.0 of the Grafana Operator.	85d ago
CVE-2026-42129	7.7	high	loki datasource	A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Lok	75d ago
CVE-2026-33382	7.5	high	grafana	Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before proc	57d ago
CVE-2026-42127	7.5	high	grafana	The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated a	75d ago
CVE-2026-33376	7.4	high	grafana	When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.	115d ago
CVE-2026-9029	7.3	high	grafana	A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile l	75d ago
CVE-2026-33377	7.1	high	grafana	An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.	115d ago

Filter the full tracker by Grafana →