G
Vendor security profile2 actively exploited CVEs
grafana
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs60
Critical4
CISA KEV2
Public exploit2
Patch rate%3
Avg. CVSS6.6
12-month vulnerability rate
1
0
2
3
8
5
10
7
7
7
7
1
CVE KEV
CVE severity distribution
60toplam CVE
Critical4 (7%)
High21 (35%)
Medium32 (53%)
Low3 (5%)
Patch and exploitation view
%3
Verified patch
%3
CISA KEV
%3
Public exploit
1Patch available
1Partial
1Workaround
0Vendor: no patch
57Unknown
Latest vulnerabilities
6.5
CVE-2026-89039
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
G
Patch status unknownEPSS %0
5.4
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards via the dashboard API
G
Patch status unknownEPSS %0
4.3
CVE-2026-13719
Alert rules in restricted folders disclosed via the alert rules list API
G
Patch status unknownEPSS %0
4.3
CVE-2026-81842
Library panel can be moved into a folder without library panel create permission
G
Patch status unknownEPSS %0
5.3
CVE-2026-81841
Paused shared dashboard access tokens still expose data source configuration
G
Patch status unknownEPSS %0
8.8
CVE-2026-15815
CVE-2026-15815 CVE Record
G
Patch status unknownEPSS %1
7.3
CVE-2026-76154
CVE-2026-76154 CVE Record
G
Patch status unknownEPSS %0
8.1
CVE-2026-14199
Incorrect authorization in Grafana
G
Patch status unknownEPSS %0
7.7
CVE-2026-75889
CVE-2026-75889 CVE Record
G
Patch status unknownEPSS %0
6.1
CVE-2026-19854
CVE-2026-19854 CVE Record
G
Patch status unknownEPSS %0