G
Vendor security profile
grafana
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs65
Critical0
CISA KEV0
Public exploit0
Patch rate—
Avg. CVSS—
12-month vulnerability rate
CVE KEV
CVE severity distribution
65toplam CVE
Uncertain65 (100%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
65Unknown
Latest vulnerabilities
7.1
CVE-2026-9703Viewer role can create, modify and delete Loki alerting rules
Patch status unknown
6.5
CVE-2026-33374Unbounded memory allocation in the Prometheus rule conversion API
Patch status unknownEPSS %0
6.5
CVE-2026-15577Git Sync connection configuration can be modified with read-only access
Patch status unknownEPSS %0
6.3
CVE-2026-93294Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
Patch status unknownEPSS %0
5.3
CVE-2026-95502Git Sync memory exhaustion via a malicious Git server
Patch status unknownEPSS %0
6.5
CVE-2026-89039Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Patch status unknownEPSS %0
5.4
CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard API
Patch status unknownEPSS %0
4.3
CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API
Patch status unknownEPSS %0
4.3
CVE-2026-81842Library panel can be moved into a folder without library panel create permission
Patch status unknownEPSS %0
5.3
CVE-2026-81841Paused shared dashboard access tokens still expose data source configuration
Patch status unknownEPSS %0