Grafana vulnerabilities2 known to be exploited.
Grafana has 91 published vulnerabilities across 13 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Grafana, with 77. If you run Grafana software, patch the exploited flaws first.
The most recent Grafana flaw added to the known-exploited list is CVE-2021-43798, on 9 October 2025. We keep watching the known-exploited list.
Which Grafana products have the most vulnerabilities?
Grafana leads with 77 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Grafana vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.5Grafana Path Traversal Vulnerability
Grafana contains a path traversal vulnerability that could allow access to local files.
- 9.8Grafana Authentication Bypass Vulnerability
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
Which Grafana flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Grafana is an open source data visualization platform.
- >99%CVE-2020-13379High
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.
- 97%CVE-2024-9264Critical
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
- 97%CVE-2025-4123High
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.
- 85%CVE-2021-41174Medium
Grafana is an open-source platform for monitoring and observability.
- 83%CVE-2021-27358High
The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
- 64%CVE-2018-15727Critical
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
- 63%CVE-2019-15043High
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
All Grafana products we track.
11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Grafanagrafana77 vulnerabilities502 versions
- Agentagent2 vulnerabilities109 versions
- Enterprise Metricsenterprise_metrics2 vulnerabilities11 versions
- Piechart-Panelpiechart-panel2 vulnerabilities21 versions
- Alloyalloy1 vulnerability15 versions
- Google Sheetsgoogle_sheets1 vulnerability15 versions
- Grafana-Image-Renderergrafana-image-renderer1 vulnerability29 versions
- Lokiloki1 vulnerability21 versions
- Oncalloncall1 vulnerability281 versions
- Worldmap Panelworldmap_panel1 vulnerability30 versions
- JSON API Data Sourcejson_api_data_source0 vulnerabilities48 versions
This directory lists the 11 Grafana products with at least one tracked version, of 13 in our catalogue.
Running Grafana? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Grafana contains a path traversal vulnerability that could allow access to local files.
- Matched to
- Grafana on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 91 published vulnerabilities across 13 products and 1,082 versions from Grafana. The most recent Grafana flaw added to the known-exploited list is CVE-2021-43798, on 9 October 2025.
2 Grafana vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-43798 and CVE-2021-39226. The full list is on this page.
Grafana, with 77 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Grafana products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.