CVEs for Grafana Cloud
86 matching vulnerabilities, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules
CVSS 7.1 highEPSS 0.19%Grafana Cloud
CVE-2026-33374 Unbounded memory allocation in the Prometheus rule conversion API
CVSS 6.5 mediumEPSS 0.37%Grafana Cloud
CVE-2026-15577 Git Sync connection configuration can be modified with read-only access
CVSS 6.5 mediumEPSS 0.27%Grafana Cloud
CVE-2026-95502 Git Sync memory exhaustion via a malicious Git server
CVSS 5.3 mediumEPSS 0.37%Grafana Cloud
CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
CVSS 6.5 mediumEPSS 0.38%Grafana Cloud
CVE-2026-13719 Alert rules in restricted folders disclosed via the alert rules list API
CVSS 4.3 mediumEPSS 0.24%Grafana Cloud
CVE-2026-81841 Paused shared dashboard access tokens still expose data source configuration
CVSS 5.3 mediumEPSS 0.38%Grafana Cloud
CVE-2026-15815 CVE-2026-15815 CVE Record
CVSS 8.8 highEPSS 0.69%Grafana Cloud
CVE-2026-76154 CVE-2026-76154 CVE Record
CVSS 7.3 highEPSS 0.35%Grafana Cloud
CVE-2026-14199 Session takeover via Auth Proxy cache key collision
CVSS 7.1 highEPSS 0.33%Grafana Cloud
CVE-2026-12704 SAML assertion replay via skipped InResponseTo validation
CVSS 6.8 mediumEPSS 0.29%Grafana Cloud
CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro
CVSS 6.5 mediumEPSS 0.42%Grafana Cloud
CVE-2026-75889 CVE-2026-75889 CVE Record
CVSS 7.7 highEPSS 0.22%Grafana Cloud
CVE-2026-19854 CVE-2026-19854 CVE Record
CVSS 6.1 mediumEPSS 0.07%Grafana Cloud
CVE-2026-19197 Broken access control in dashboard snapshots
CVSS 6.3 mediumEPSS 0.15%Grafana Cloud
CVE-2026-17033 CVE-2026-17033 CVE Record
CVSS 6.8 mediumEPSS 0.22%Grafana Cloud
CVE-2026-17183 CVE-2026-17183 CVE Record
CVSS 7.1 highEPSS 0.29%Grafana Cloud
CVE-2026-11817 CVE-2026-11817 CVE Record
CVSS 5.3 mediumEPSS 0.35%Grafana Cloud
CVE-2026-19516 CVE-2026-19516 CVE Record
CVSS 9.1 criticalEPSS 0.31%Grafana Cloud
CVE-2026-9765 CVE-2026-9765 CVE Record
CVSS 7.1 highEPSS 0.40%Grafana Cloud
CVE-2026-21723 CVE-2026-21723 Record
CVSS 5.3 mediumEPSS 0.22%Grafana Cloud
CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
CVSS 8.6 highEPSS 0.53%Grafana Cloud
CVE-2026-8595 Stored XSS in the table panel (TableNG)
CVSS 6.8 mediumEPSS 0.24%Grafana Cloud
CVE-2026-8609 Pre-authentication denial of service via the OAuth login route
CVSS 5.3 mediumEPSS 0.40%Grafana Cloud
CVE-2026-33382 Denial of service via unbounded request body size
CVSS 7.5 highEPSS 0.39%Grafana Cloud
CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVSS 9.6 criticalEPSS 0.35%Grafana Cloud
CVE-2026-9029 Stored XSS in the Geomap panel tile-layer attribution
CVSS 7.3 highEPSS 0.25%Grafana Cloud
CVE-2026-10601 Path traversal in the Tempo and Loki data source plugins
CVSS 5.4 mediumEPSS 0.29%Grafana Cloud
CVE-2026-42129 Path traversal in the Loki data source plugin
CVSS 7.7 highEPSS 0.44%Grafana Cloud
CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage
CVSS 6.5 mediumEPSS 0.41%Grafana Cloud
CVE-2026-11769 Operator - Namespaced User Path Traversal
CVSS 8.8 highEPSS 0.36%Grafana Cloud
CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation
CVSS 4.3 mediumEPSS 0.20%Grafana Cloud
CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation
CVSS 6.5 mediumEPSS 0.33%Grafana Cloud
CVE-2026-33376 Auth Proxy IPv6 whitelist bypass
CVSS 7.4 highEPSS 0.28%Grafana Cloud
CVE-2026-33380 SQL Expressions Read File From Disk
CVSS 6.3 mediumEPSS 0.35%Grafana Cloud
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
CVSS 6.5 mediumEPSS 0.23%Grafana Cloud
CVE-2026-33381 Users can generate Service Account tokens after permissions removal
CVSS 5.9 mediumEPSS 0.33%Grafana Cloud
CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM
CVSS 6.5 mediumEPSS 0.33%Grafana Cloud
CVE-2026-21728 Tempo query limit results in unbounded memory allocation
CVSS 7.5 highEPSS 0.64%Grafana Cloud
CVE-2026-21726 Loki Path Traversal - CVE-2021-36156 Bypass
CVSS 5.3 mediumEPSS 0.41%Grafana Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)