G
Vendor security profile2 actively exploited CVEs
grafana
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs64
Critical4
CISA KEV2
Public exploit4
Patch rate%3
Avg. CVSS6.6
12-month vulnerability rate
1
0
2
3
8
5
10
7
7
7
7
5
CVE KEV
CVE severity distribution
64toplam CVE
Critical4 (6%)
High21 (33%)
Medium36 (56%)
Low3 (5%)
Patch and exploitation view
%3
Verified patch
%3
CISA KEV
%6
Public exploit
1Patch available
1Partial
1Workaround
0Vendor: no patch
61Unknown
Latest vulnerabilities
6.5
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversion API
G
Patch status unknownEPSS %0
6.5
CVE-2026-15577
Git Sync connection configuration can be modified with read-only access
G
Patch status unknownEPSS %0
6.3
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
G
Patch status unknownEPSS %0
5.3
CVE-2026-95502
Git Sync memory exhaustion via a malicious Git server
G
Patch status unknownEPSS %0
6.5
CVE-2026-89039
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
G
Patch status unknownEPSS %0
5.4
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards via the dashboard API
G
Patch status unknownEPSS %0
4.3
CVE-2026-13719
Alert rules in restricted folders disclosed via the alert rules list API
G
Patch status unknownEPSS %0
4.3
CVE-2026-81842
Library panel can be moved into a folder without library panel create permission
G
Patch status unknownEPSS %0
5.3
CVE-2026-81841
Paused shared dashboard access tokens still expose data source configuration
G
Patch status unknownEPSS %0
8.8
CVE-2026-15815
CVE-2026-15815 CVE Record
G
Patch status unknownEPSS %1