Read the docs

Grafana

Records175All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high67CVSS 7.0–8.9

Exploited now

Grafana records in CISA KEV
TI-2021-19604 Grafana Path Traversal Vulnerability Priority CRITICAL 90KEV 2025-10-09TI-2021-16611 Grafana Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2022-08-25

Components

Products in the NVD configurations · select one to filter the records
Grafana 104 records CRITICAL Tempo 3 records MEDIUM Agent 2 records LOW Enterprise Metrics 2 records LOW Loki 2 records LOW Piechart-panel 2 records LOW Alloy 1 record LOW Google Sheets 1 record LOW

Records

2 records in Loki · all components

TI-2026-17499 CVE-2026-21726 · GHSA-497x-rrr9-68jp

Loki Path Traversal - CVE-2021-36156 Bypass

Priority LOW 24

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Tha…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00409 Published 2026-04-15 Partial fix · 3.5.9, 3.6.4 CWE-22
Open these records in search →