Grafana Enterprise
Grafana
- Product type
- Other
- Catalog vulnerabilities
- 28
Severity across 27 analyzed records
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/06/2026, within CyStack's analyzed data, Grafana Enterprise has 11 security vulnerabilities published in the last 90 days. Of these, 4 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Grafana Enterprise and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API | Exploitation statusNot known exploited | FixYes | Published09/30/2026 | SeverityMedium |
CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API | Exploitation statusNot known exploited | FixYes | Published09/30/2026 | SeverityMedium |
CVE-2026-81842Library panel can be moved into a folder without library panel create permission | Exploitation statusNot known exploited | FixYes | Published09/29/2026 | SeverityMedium |
CVE-2026-81841Paused shared dashboard access tokens still expose data source configuration | Exploitation statusNot known exploited | FixYes | Published09/29/2026 | SeverityMedium |
CVE-2026-15815CVE-2026-15815 CVE Record | Exploitation statusNot known exploited | FixYes | Published09/17/2026 | SeverityHigh |
CVE-2026-76154CVE-2026-76154 CVE Record | Exploitation statusNot known exploited | FixYes | Published09/17/2026 | SeverityHigh |
CVE-2026-14199Session takeover via Auth Proxy cache key collision | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityHigh |
CVE-2026-12704SAML assertion replay via skipped InResponseTo validation | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityMedium |
CVE-2026-19197Broken access control in dashboard snapshots | Exploitation statusNot known exploited | FixYes | Published08/26/2026 | SeverityMedium |
CVE-2026-17183CVE-2026-17183 CVE Record | Exploitation statusNot known exploited | FixYes | Published08/19/2026 | SeverityHigh |
CVE-2026-11817CVE-2026-11817 CVE Record | Exploitation statusNot known exploited | FixYes | Published08/17/2026 | SeverityMedium |
CVE-2026-28378Cross-Organization Public Dashboard Deletion via Missing Org Isolation | Exploitation statusNot known exploited | FixYes | Published07/07/2026 | SeverityLow |
CVE-2026-42127Pre-authentication denial of service in the public dashboard query endpoint | Exploitation statusNot known exploited | FixYes | Published06/22/2026 | SeverityHigh |
CVE-2026-27876RCE on Grafana via sqlExpressions | Exploitation statusNot known exploited | FixYes | Published03/27/2026 | SeverityCritical |
CVE-2025-41115Incorrect privilege assignment | Exploitation statusNot known exploited | FixYes | Published11/21/2025 | SeverityCritical |
CVE-2025-3454 | Exploitation statusNot known exploited | FixYes | Published06/02/2025 | SeverityMedium |
CVE-2025-2703 | Exploitation statusNot known exploited | FixYes | Published04/23/2025 | SeverityMedium |
CVE-2024-6322 | Exploitation statusNot known exploited | FixYes | Published08/20/2024 | SeverityMedium |
CVE-2023-6152 | Exploitation statusPublic exploit | FixYes | Published02/13/2024 | SeverityMedium |
CVE-2023-4399 | Exploitation statusNot known exploited | FixYes | Published10/17/2023 | SeverityMedium |
CVE-2023-4822 | Exploitation statusNot known exploited | FixYes | Published10/16/2023 | SeverityMedium |
CVE-2023-3128 | Exploitation statusPublic exploit | FixYes | Published06/22/2023 | SeverityCritical |
CVE-2023-2183 | Exploitation statusPublic exploit | FixYes | Published06/06/2023 | SeverityMedium |
CVE-2023-2801 | Exploitation statusNot known exploited | FixYes | Published06/06/2023 | SeverityHigh |
CVE-2023-1387 | Exploitation statusPublic exploit | FixYes | Published04/26/2023 | SeverityMedium |
CVE-2023-1410Stored XSS in Graphite FunctionDescription tooltip | Exploitation statusPublic exploit | FixYes | Published03/23/2023 | SeverityMedium |
CVE-2023-0594 | Exploitation statusNot known exploited | FixYes | Published03/01/2023 | SeverityHigh |
CVE-2023-0507 | Exploitation statusNot known exploited | FixYes | Published03/01/2023 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
