Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 07:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

164-72% vs 7-day avg of 596

3 critical, 57 high, 70 medium, 29 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.7	CVE-2026-92539	A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance... GrafanaGrafana Enterprise	NVD	Oct 20 17:17 UTC
CVE-2026-92539A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance... From the advisory A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H Affects Grafana Grafana Enterprise NIST National Vulnerability DatabasePublished Oct 20, 2026 17:17 UTC Read the advisory
	High	7.1	CVE-2026-9703	Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources GrafanaGrafana Enterprise, Grafana OSS	NVD	Oct 15 15:17 UTC
CVE-2026-9703Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources From the advisory Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Oct 15, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-95502	A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled... GrafanaGrafana Enterprise, Grafana OSS, Grafana Nanogit	NVD	Oct 13 18:17 UTC
CVE-2026-95502A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled... From the advisory A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects Grafana Grafana Enterprise Grafana OSS Grafana Nanogit NIST National Vulnerability DatabasePublished Oct 13, 2026 18:17 UTC Read the advisory
	Medium	6.3	CVE-2026-93294	A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure... GrafanaGrafana Enterprise, Grafana OSS	NVD	Oct 13 18:17 UTC
CVE-2026-93294A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure... From the advisory A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Oct 13, 2026 18:17 UTC Read the advisory
	Medium	6.5	CVE-2026-33374	The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the... GrafanaGrafana Enterprise, Grafana OSS	NVD	Oct 13 18:17 UTC
CVE-2026-33374The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the... From the advisory The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Oct 13, 2026 18:17 UTC Read the advisory
	Medium	6.5	CVE-2026-15577	A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect... GrafanaGrafana Enterprise, Grafana OSS	NVD	Oct 13 18:17 UTC
CVE-2026-15577A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect... From the advisory A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Oct 13, 2026 18:17 UTC Read the advisory
	Medium	6.5	CVE-2026-89039	A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable... GrafanaGrafana mcp-k6	NVD	Oct 5 15:17 UTC
CVE-2026-89039A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable... From the advisory A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Grafana Grafana mcp-k6 NIST National Vulnerability DatabasePublished Oct 5, 2026 15:17 UTC Read the advisory
	Medium	5.4	CVE-2026-13720	An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the... GrafanaGrafana Enterprise, Grafana OSS	NVD	Sep 30 11:16 UTC
CVE-2026-13720An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the... From the advisory An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Sep 30, 2026 11:16 UTC Read the advisory
	Medium	4.3	CVE-2026-13719	An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint GrafanaGrafana Enterprise, Grafana OSS	NVD	Sep 30 11:16 UTC
CVE-2026-13719An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint From the advisory An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Sep 30, 2026 11:16 UTC Read the advisory
	Medium	4.3	CVE-2026-81842	An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or... GrafanaGrafana Enterprise, Grafana OSS	NVD	Sep 29 21:19 UTC
CVE-2026-81842An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or... From the advisory An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Sep 29, 2026 21:19 UTC Read the advisory
	Medium	5.3	CVE-2026-81841	Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data GrafanaGrafana Enterprise, Grafana OSS	NVD	Sep 29 21:19 UTC
CVE-2026-81841Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data From the advisory Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Grafana Grafana Enterprise Grafana OSS NIST National Vulnerability DatabasePublished Sep 29, 2026 21:19 UTC Read the advisory
	Critical	n/a	RHSA-2026:89744	grafana security update Red Hat, Grafana, golang.org/x/netRed Hat Enterprise Linux, golang.org/x/net/http2, Grafana	Red Hat Security Advisories	Oct 26 03:03 UTC
RHSA-2026:89744grafana security update Executive summary Red Hat's advisory RHSA-2026:89744 covers the grafana package for Red Hat Enterprise Linux 9 and fixes five security vulnerabilities, including an information disclosure flaw in Grafana Unified Alerting and several Go standard library flaws. Red Hat rated the update as having a Critical security impact. Red Hat recommends applying the updated grafana packages, and the advisory points to its standard update instructions for how to do so. Technical summary The advisory lists five CVEs: CVE-2026-17183 (information disclosure in Grafana Unified Alerting), CVE-2026-78667 and CVE-2026-78669 (denial of service via crafted HTTP Range headers and excessive HTTP/2 SETTINGS frames in net/http), CVE-2026-97031 (denial of service via multiple ECH outer extension references in crypto/tls), and CVE-2026-111943 (man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509). The fixed version is grafana-10.2.6-23.el9_8.7 for the affected RHEL 9 streams. The advisory does not state the attack vector or preconditions for each flaw, does not give a CVSS score in the text (it refers to CVE pages), and does not state any workaround. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go net/http Dropped extracted product not named in the source: Go crypto/tls Dropped extracted product not named in the source: Go crypto/x509 Summarized from access.redhat.com/errata/RHSA-2026:89744 Score No CVSS score published. Affects Red Hat Grafana golang.org/x/net Red Hat Enterprise Linux golang.org/x/net/http2 Grafana Red Hat Product SecurityPublished Oct 26, 2026 03:03 UTC Read the advisory
	High	n/a	RHSA-2026:89732	grafana security update Red Hat, GrafanaGrafana, Red Hat Enterprise Linux for x86_64 10	Red Hat Security Advisories	Oct 26 01:46 UTC
RHSA-2026:89732grafana security update Executive summary Red Hat has released a security update for grafana, the open source metrics dashboard, on Red Hat Enterprise Linux 10. Red Hat rates the update as Important and says it fixes an information disclosure flaw in Grafana Unified Alerting and a denial of service flaw in the Go net/textproto and mime/multipart packages. The recommended action is to apply the grafana package update listed in the advisory. Technical summary The advisory describes two fixes: CVE-2026-17183, an information disclosure vulnerability in Grafana Unified Alerting, and CVE-2026-94440, a denial of service caused by a memory limit bypass in multipart form parsing in the Go net/textproto and mime/multipart packages. The advisory does not state the attack vector, required privileges, or CVSS scores, and refers readers to the CVE pages for those details. The fixed package is grafana-10.2.6-28.el10_2.9, and the advisory lists its SHA-256 checksums for each architecture. No workarounds or detection guidance are stated, and exploitation in the wild is not stated. Vendor-specific update steps are referred to https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go net/textproto Dropped extracted product not named in the source: Go mime/multipart Summarized from access.redhat.com/errata/RHSA-2026:89732 Score No CVSS score published. Affects Red Hat Grafana Grafana Red Hat Enterprise Linux for x86_64 10 Red Hat Product SecurityPublished Oct 26, 2026 01:46 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects