Grafana
Number 132 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Grafana, Grafana Labs, grafana
Total vulnerabilities
145
Critical
11
High
46
Known Exploited
2
Exploit available
0
Visible in Bangladesh
1,277
Services seen by internet scanning
Network, no login needed
22.1%
Of 145 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 74 | 4 | 25 | 41 | 4 | 0 |
| 2025 | 16 | 2 | 3 | 8 | 3 | 0 |
| 2024 | 13 | 1 | 4 | 7 | 1 | 0 |
| 2023 | 15 | 1 | 6 | 8 | 0 | 0 |
| 2022 | 20 | 1 | 7 | 12 | 0 | 0 |
| 2021 | 7 | 2 | 1 | 4 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Grafana | 30 | 10 |
| Grafana OSS | 29 | 9 |
| grafana | 28 | 11 |
| Grafana Enterprise | 19 | 7 |
| grafana/grafana | 3 | 1 |
| Alloy | 2 | 2 |
| Grafana MCP Server | 2 | 2 |
| Loki | 2 | 1 |
| Tempo | 2 | 2 |
| grafana-image-renderer | 2 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 18 | 9 |
| Incorrect Authorization | 14 | 6 |
| Denial of Service | 13 | 4 |
| Information Disclosure | 12 | 2 |
| Path Traversal | 11 | 5 |
| Improper Access Control | 9 | 4 |
| Missing Authorization | 5 | 1 |
| Server-Side Request Forgery | 5 | 3 |
| Code Injection | 4 | 4 |
| Improper Input Validation | 4 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2021-43798 | Grafana path traversal | High | 88.5% | |
| CVE-2021-39226 | Snapshot authentication bypass in grafana | Critical | 99.9% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-33379 | Dashboard snapshot permission bypass | High | 0.2% | |
| CVE-2026-81938 | Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir | High | 0.4% | |
| CVE-2026-88967 | Azure Monitor access token disclosure via SSRF | High | 0.3% | |
| CVE-2026-88858 | Server-side expression parser denial of service | Medium | 0.4% | |
| CVE-2026-79656 | OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors | Medium | 0.2% | |
| CVE-2026-103506 | SSO settings authorization bypass | High | 0.3% | |
| CVE-2026-100105 | Alerting contact point authorization bypass via schema downgrade | High | 0.3% | |
| CVE-2026-16491 | CVE-2026-16491 CVE Record | Medium | 0.3% | |
| CVE-2026-92539 | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | Medium | 0.3% | |
| CVE-2026-9703 | Viewer role can create, modify and delete Loki alerting rules | High | 0.2% |