• See https://grafana.com/security/security-advisories/
• See also https://github.com/grafana/grafana/security/advisories/

Note that for instance GHSA-jv32-5578-pxjc is NOT present in https://github.com/github/advisory-database

There is also loki that is part of the toolset.

And https://github.com/credativ/plutono and https://github.com/credativ/vali that are forks of grafana and loki respectively.