CVE WATCH / VULNERABILITY DETAIL
CVE-2026-33379
HIGHCVSS 8.5NVD feed
Published 6 November 2026 · tracked since 6 November 2026
Description
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-92895 HIGH 8.1
- CVE-2026-116624 HIGH 8.8
- CVE-2026-114630 CRITICAL 9.1
- CVE-2026-107622 CRITICAL 9.8
- CVE-2026-104010 HIGH 7.5
- CVE-2026-103479 HIGH 7.6
- CVE-2026-123325 HIGH 7.1
- CVE-2026-123321 HIGH 7.8
- CVE-2026-123306 HIGH 7.4
- CVE-2026-123304 HIGH 7.8