# Grafana Cloud CVEs > Grafana Cloud: 86 CVEs mapped to its software or packages (2 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/grafana-cloud/cves Last updated: 2026-10-20T16:55:17Z 86 CVEs map to Grafana Cloud (2 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Grafana Cloud’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-20 | [CVE-2026-92539](https://rewindex.com/cve/CVE-2026-92539.md) | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | 6.7 medium | | | 2026-10-15 | [CVE-2026-9703](https://rewindex.com/cve/CVE-2026-9703.md) | Viewer role can create, modify and delete Loki alerting rules | 7.1 high | | | 2026-10-13 | [CVE-2026-33374](https://rewindex.com/cve/CVE-2026-33374.md) | Unbounded memory allocation in the Prometheus rule conversion API | 6.5 medium | | | 2026-10-13 | [CVE-2026-15577](https://rewindex.com/cve/CVE-2026-15577.md) | Git Sync connection configuration can be modified with read-only access | 6.5 medium | | | 2026-10-13 | [CVE-2026-93294](https://rewindex.com/cve/CVE-2026-93294.md) | Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs | 6.3 medium | | | 2026-10-13 | [CVE-2026-95502](https://rewindex.com/cve/CVE-2026-95502.md) | Git Sync memory exhaustion via a malicious Git server | 5.3 medium | | | 2026-10-05 | [CVE-2026-89039](https://rewindex.com/cve/CVE-2026-89039.md) | Arbitrary file read via the convert\_playwright\_script prompt in mcp-k6 | 6.5 medium | | | 2026-09-30 | [CVE-2026-13720](https://rewindex.com/cve/CVE-2026-13720.md) | Editor can forge file-provisioning provenance on dashboards via the dashboard API | 5.4 medium | | | 2026-09-30 | [CVE-2026-13719](https://rewindex.com/cve/CVE-2026-13719.md) | Alert rules in restricted folders disclosed via the alert rules list API | 4.3 medium | | | 2026-09-29 | [CVE-2026-81842](https://rewindex.com/cve/CVE-2026-81842.md) | Library panel can be moved into a folder without library panel create permission | 4.3 medium | | | 2026-09-29 | [CVE-2026-81841](https://rewindex.com/cve/CVE-2026-81841.md) | Paused shared dashboard access tokens still expose data source configuration | 5.3 medium | | | 2026-09-17 | [CVE-2026-15815](https://rewindex.com/cve/CVE-2026-15815.md) | CVE-2026-15815 CVE Record | 8.8 high | | | 2026-09-17 | [CVE-2026-76154](https://rewindex.com/cve/CVE-2026-76154.md) | CVE-2026-76154 CVE Record | 7.3 high | | | 2026-09-02 | [CVE-2026-14199](https://rewindex.com/cve/CVE-2026-14199.md) | Session takeover via Auth Proxy cache key collision | 7.1 high | | | 2026-09-02 | [CVE-2026-12704](https://rewindex.com/cve/CVE-2026-12704.md) | SAML assertion replay via skipped InResponseTo validation | 6.8 medium | | | 2026-09-02 | [CVE-2026-19475](https://rewindex.com/cve/CVE-2026-19475.md) | SQL Data Source Plugin: OOM DoS via $\_\_timeGroup macro | 6.5 medium | | | 2026-08-27 | [CVE-2026-75889](https://rewindex.com/cve/CVE-2026-75889.md) | CVE-2026-75889 CVE Record | 7.7 high | | | 2026-08-27 | [CVE-2026-19854](https://rewindex.com/cve/CVE-2026-19854.md) | CVE-2026-19854 CVE Record | 6.1 medium | | | 2026-08-26 | [CVE-2026-19197](https://rewindex.com/cve/CVE-2026-19197.md) | Broken access control in dashboard snapshots | 6.3 medium | | | 2026-08-24 | [CVE-2026-17033](https://rewindex.com/cve/CVE-2026-17033.md) | CVE-2026-17033 CVE Record | 6.8 medium | | | 2026-08-19 | [CVE-2026-17183](https://rewindex.com/cve/CVE-2026-17183.md) | CVE-2026-17183 CVE Record | 7.1 high | | | 2026-08-17 | [CVE-2026-11817](https://rewindex.com/cve/CVE-2026-11817.md) | CVE-2026-11817 CVE Record | 5.3 medium | | | 2026-08-11 | [CVE-2026-19516](https://rewindex.com/cve/CVE-2026-19516.md) | CVE-2026-19516 CVE Record | 9.1 critical | | | 2026-07-24 | [CVE-2026-9765](https://rewindex.com/cve/CVE-2026-9765.md) | CVE-2026-9765 CVE Record | 7.1 high | | | 2026-07-23 | [CVE-2026-21723](https://rewindex.com/cve/CVE-2026-21723.md) | CVE-2026-21723 Record | 5.3 medium | | | 2026-07-16 | [CVE-2026-21729](https://rewindex.com/cve/CVE-2026-21729.md) | Loki detected\_fields query limits results in unbounded memory allocation | 7.5 high | | | 2026-07-15 | [CVE-2026-15583](https://rewindex.com/cve/CVE-2026-15583.md) | SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header | 8.6 high | | | 2026-07-10 | [CVE-2026-8595](https://rewindex.com/cve/CVE-2026-8595.md) | Stored XSS in the table panel (TableNG) | 6.8 medium | | | 2026-07-10 | [CVE-2026-8609](https://rewindex.com/cve/CVE-2026-8609.md) | Pre-authentication denial of service via the OAuth login route | 5.3 medium | | | 2026-07-10 | [CVE-2026-33382](https://rewindex.com/cve/CVE-2026-33382.md) | Denial of service via unbounded request body size | 7.5 high | | | 2026-07-07 | [CVE-2026-28378](https://rewindex.com/cve/CVE-2026-28378.md) | Cross-Organization Public Dashboard Deletion via Missing Org Isolation | 3.1 low | | | 2026-06-22 | [CVE-2026-42127](https://rewindex.com/cve/CVE-2026-42127.md) | Pre-authentication denial of service in the public dashboard query endpoint | 7.5 high | | | 2026-06-22 | [CVE-2026-28381](https://rewindex.com/cve/CVE-2026-28381.md) | Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT | 9.6 critical | | | 2026-06-22 | [CVE-2026-9029](https://rewindex.com/cve/CVE-2026-9029.md) | Stored XSS in the Geomap panel tile-layer attribution | 7.3 high | | | 2026-06-22 | [CVE-2026-10601](https://rewindex.com/cve/CVE-2026-10601.md) | Path traversal in the Tempo and Loki data source plugins | 5.4 medium | | | 2026-06-22 | [CVE-2026-42129](https://rewindex.com/cve/CVE-2026-42129.md) | Path traversal in the Loki data source plugin | 7.7 high | | | 2026-06-19 | [CVE-2026-27878](https://rewindex.com/cve/CVE-2026-27878.md) | Tempo TraceQL query with exemplar hint could result in unbounded memory usage | 6.5 medium | | | 2026-06-13 | [CVE-2026-11769](https://rewindex.com/cve/CVE-2026-11769.md) | Operator - Namespaced User Path Traversal | 8.8 high | | | 2026-05-13 | [CVE-2026-28374](https://rewindex.com/cve/CVE-2026-28374.md) | IDOR in Annotations API allows unprivileged users to DELETE annotation | 4.3 medium | | | 2026-05-13 | [CVE-2026-33378](https://rewindex.com/cve/CVE-2026-33378.md) | Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $\_\_timeGroup Macro | 6.5 medium | | | 2026-05-13 | [CVE-2026-28383](https://rewindex.com/cve/CVE-2026-28383.md) | Grafana plugin resources can lead to unbounded memory allocation | 6.5 medium | | | 2026-05-13 | [CVE-2026-33376](https://rewindex.com/cve/CVE-2026-33376.md) | Auth Proxy IPv6 whitelist bypass | 7.4 high | | | 2026-05-13 | [CVE-2026-33380](https://rewindex.com/cve/CVE-2026-33380.md) | SQL Expressions Read File From Disk | 6.3 medium | | | 2026-05-13 | [CVE-2026-28380](https://rewindex.com/cve/CVE-2026-28380.md) | BAC in Snapshot API allows deletion of unauthorized dashboard snapshots | 6.5 medium | | | 2026-05-13 | [CVE-2026-33381](https://rewindex.com/cve/CVE-2026-33381.md) | Users can generate Service Account tokens after permissions removal | 5.9 medium | | | 2026-05-13 | [CVE-2026-33377](https://rewindex.com/cve/CVE-2026-33377.md) | Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin | 7.1 high | | | 2026-05-13 | [CVE-2026-28376](https://rewindex.com/cve/CVE-2026-28376.md) | Grafana Live push endpoint allows unbounded memory allocation leading to OOM | 6.5 medium | | | 2026-05-13 | [CVE-2026-28379](https://rewindex.com/cve/CVE-2026-28379.md) | Viewer-triggered race condition in Grafana Live leads to complete server crash | 6.5 medium | | | 2026-04-24 | [CVE-2026-21728](https://rewindex.com/cve/CVE-2026-21728.md) | Tempo query limit results in unbounded memory allocation | 7.5 high | | | 2026-04-15 | [CVE-2026-21726](https://rewindex.com/cve/CVE-2026-21726.md) | Loki Path Traversal - CVE-2021-36156 Bypass | 5.3 medium | | Next page: [page 2](https://rewindex.com/company/grafana-cloud/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Grafana Cloud) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 2 | 0 | 0 | | 2025-11-17 | 1 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 2 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 1 | 2 | 5 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 1 | 0 | 2 | 1 | 0 | 0 | | 2026-04-20 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 2 | 8 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-06-22 | 1 | 3 | 1 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 1 | 2 | 1 | 0 | 0 | | 2026-07-13 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-08-24 | 0 | 1 | 3 | 0 | 0 | 0 | | 2026-08-31 | 0 | 1 | 2 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 4 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-10-12 | 0 | 1 | 4 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/grafana-cloud/cves · Markdown: https://rewindex.com/company/grafana-cloud/cves.md · JSON: https://rewindex.com/api/v1/companies/grafana-cloud/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:14:00.097Z