# Grafana vulnerabilities > Grafana has 91 published vulnerabilities across 13 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Grafana, with 77. If you run Grafana software, patch the exploited flaws first. Canonical page: https://www.precursorintelligence.com/vendors/grafana ## At a glance - **Published vulnerabilities:** 91 - **Known to be exploited:** 2 - **Products:** 13 - **Versions:** 1,082 - **Most recently added to the known-exploited list:** [CVE-2021-43798](https://www.precursorintelligence.com/what-is/cve-2021-43798), 9 October 2025. We keep watching the list. ## Which Grafana products have the most vulnerabilities? - [Grafana](https://www.precursorintelligence.com/product/grafana/grafana): 77 published vulnerabilities, 502 versions - [Enterprise Metrics](https://www.precursorintelligence.com/product/grafana/enterprise_metrics): 2 published vulnerabilities, 11 versions - [Piechart-Panel](https://www.precursorintelligence.com/product/grafana/piechart-panel): 2 published vulnerabilities, 21 versions - [Agent](https://www.precursorintelligence.com/product/grafana/agent): 2 published vulnerabilities, 109 versions - [Loki](https://www.precursorintelligence.com/product/grafana/loki): 1 published vulnerability, 21 versions - [Oncall](https://www.precursorintelligence.com/product/grafana/oncall): 1 published vulnerability, 281 versions - [Synthetic Monitoring Agent](https://www.precursorintelligence.com/product/grafana/synthetic_monitoring_agent): 1 published vulnerability, 0 versions - [Tempo](https://www.precursorintelligence.com/product/grafana/tempo): 1 published vulnerability, 0 versions - [Worldmap Panel](https://www.precursorintelligence.com/product/grafana/worldmap_panel): 1 published vulnerability, 30 versions - [Alloy](https://www.precursorintelligence.com/product/grafana/alloy): 1 published vulnerability, 15 versions Each product page lists its own known-exploited flaws. ## Which Grafana vulnerabilities are being exploited? 2 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2021-43798](https://www.precursorintelligence.com/what-is/cve-2021-43798): Grafana Path Traversal Vulnerability. High, CVSS 7.5, chance of use in 30 days 89%, known exploited since 9 October 2025. - [CVE-2021-39226](https://www.precursorintelligence.com/what-is/cve-2021-39226): Grafana Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 August 2022. ## Which Grafana flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2021-39226](https://www.precursorintelligence.com/what-is/cve-2021-39226): >99%, Critical (CVSS 9.8), known exploited - [CVE-2020-13379](https://www.precursorintelligence.com/what-is/cve-2020-13379): >99%, High (CVSS 8.2) - [CVE-2024-9264](https://www.precursorintelligence.com/what-is/cve-2024-9264): 97%, Critical (CVSS 9.4) - [CVE-2025-4123](https://www.precursorintelligence.com/what-is/cve-2025-4123): 97%, High (CVSS 7.6) - [CVE-2021-41174](https://www.precursorintelligence.com/what-is/cve-2021-41174): 85%, Medium (CVSS 6.1) - [CVE-2021-27358](https://www.precursorintelligence.com/what-is/cve-2021-27358): 83%, High (CVSS 7.5) - [CVE-2018-15727](https://www.precursorintelligence.com/what-is/cve-2018-15727): 64%, Critical (CVSS 9.8) - [CVE-2019-15043](https://www.precursorintelligence.com/what-is/cve-2019-15043): 63%, High (CVSS 7.5) ## All Grafana products we track 11 products with at least one tracked version, most vulnerabilities first: - [Grafana](https://www.precursorintelligence.com/product/grafana/grafana): 77 vulnerabilities, 502 versions - [Enterprise Metrics](https://www.precursorintelligence.com/product/grafana/enterprise_metrics): 2 vulnerabilities, 11 versions - [Piechart-Panel](https://www.precursorintelligence.com/product/grafana/piechart-panel): 2 vulnerabilities, 21 versions - [Agent](https://www.precursorintelligence.com/product/grafana/agent): 2 vulnerabilities, 109 versions - [Loki](https://www.precursorintelligence.com/product/grafana/loki): 1 vulnerability, 21 versions - [Oncall](https://www.precursorintelligence.com/product/grafana/oncall): 1 vulnerability, 281 versions - [Worldmap Panel](https://www.precursorintelligence.com/product/grafana/worldmap_panel): 1 vulnerability, 30 versions - [Alloy](https://www.precursorintelligence.com/product/grafana/alloy): 1 vulnerability, 15 versions - [Google Sheets](https://www.precursorintelligence.com/product/grafana/google_sheets): 1 vulnerability, 15 versions - [Grafana-Image-Renderer](https://www.precursorintelligence.com/product/grafana/grafana-image-renderer): 1 vulnerability, 29 versions - [JSON API Data Source](https://www.precursorintelligence.com/product/grafana/json_api_data_source): 0 vulnerabilities, 48 versions ## Questions ### How many vulnerabilities does Grafana have? Our catalogue lists 91 published vulnerabilities across 13 products and 1,082 versions from Grafana. The most recent Grafana flaw added to the known-exploited list is CVE-2021-43798, on 9 October 2025. ### Which Grafana vulnerabilities are being exploited? 2 Grafana vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-43798 and CVE-2021-39226. The full list is on this page. ### Which Grafana product has the most vulnerabilities? Grafana, with 77 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new Grafana vulnerabilities? Create a Precursor Intelligence account and track the Grafana products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running Grafana? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact