Grafana-labs
29 CVEs tracked since 2022. Since Oct 2022, none of them reached CISA KEV.
Grafana-labs CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2022-10 | 4 | 0 |
| 2022-11 | 3 | 0 |
| 2022-12 | null or fewer | |
| 2023-01 | null or fewer | |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | null or fewer | |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | null or fewer | |
| 2023-08 | null or fewer | |
| 2023-09 | null or fewer | |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | null or fewer | |
| 2024-04 | null or fewer | |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | null or fewer | |
| 2024-09 | 3 | 0 |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | 9 | 0 |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | null or fewer | |
| 2026-05 | 10 | 0 |
Products
The products that kept showing up in Grafana-labs's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Grafana-labs.
- CVE-2026-28374IDOR in Annotations API allows unprivileged users to DELETE annotation4.3
- CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro6.5
- CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocation6.5
- CVE-2026-33376Auth Proxy IPv6 whitelist bypass7.4
- CVE-2026-28380BAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5
- CVE-2026-33380SQL Expressions Read File From Disk6.3
- CVE-2026-33381Users can generate Service Account tokens after permissions removal5.9
- CVE-2026-33377Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin7.1
- CVE-2026-28376Grafana Live push endpoint allows unbounded memory allocation leading to OOM6.5
- CVE-2026-28379Viewer-triggered race condition in Grafana Live leads to complete server crash6.5
- CVE-2026-21726Loki Path Traversal - CVE-2021-36156 Bypass5.3
- CVE-2025-41118Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection9.1
- CVE-2026-21727Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record3.3
- CVE-2025-12141Grafana Alerting Editors can edit destination of webhooks they did not create6.5
- BDU:2026-04993Уязвимости ИИ-модуля платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю обойти существующие механизмы безопасности и раскрыть защищаемую информацию7.5
The record
- Peak rank
- #101 in Jan 2026
- Busiest month shown
- May 2026, 10 CVEs
- Months with a KEV entry
- 0 since Oct 2022
- Monthly snapshots
- 5 since 2022