Advisories · Technology

grafana/grafana.

Every CVE that names grafana/grafana among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-21722 CVE record

CVSS 5.3 Medium

Public Dashboards time range restriction on annotations can be bypassed
- grafana/grafana
- grafana/grafana-enterprise
- Broken access control
Not analysed yet 12 Feb 2026
CVE-2026-21721 CVE record

CVSS 8.1 High

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
- grafana/grafana
- grafana/grafana-enterprise
- Broken access control
Not analysed yet 27 Jan 2026
CVE-2026-21720 CVE record

CVSS 7.5 High

Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
- grafana/grafana-enterprise
- grafana/grafana
- Denial of service
- CWE-703
Not analysed yet 27 Jan 2026