Observability
Prometheus: supported versions and open vulnerabilities today
Prometheus 3.15 and 3.13 are supported (3.15 until Nov 6, 2026); 3.14 reached end of life on Sep 30, 2026; the latest release is 3.15.0. 2 high or critical advisories for Prometheus were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 3.15.0
- GitHub stars
- 66.5k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 8.5 / 10
Supported versions
Security advisories
4 advisories published in the last 12 months, 2 of them high or critical. 5 in total since records began. Checked packages: github.com/prometheus/prometheus.
Prometheus: Remote read endpoint allows denial of service via crafted snappy payload
Fixed in 0.305.2 and 0.311.3.
EPSS: top 44%Prometheus Azure AD remote write OAuth client secret exposed via config API
Fixed in 0.311.3.
EPSS: top 73%
Maintenance and supply chain
OpenSSF Scorecard 8.5 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 15 issue updates found in the last 90 days.
Weakest checks
- Unsigned releases (Signed-Releases 0/10)
Alternatives
Datadog
Comprehensive monitoring and analytics platform
Strengths
- All-in-one platform (metrics, logs, traces)
- Beautiful dashboards
Trade-offs
- Vendor lock-in
- Requires agent installation
New Relic
Full-stack observability platform
Strengths
- Comprehensive observability
- Real user monitoring (RUM)
Trade-offs
- Vendor lock-in
- Complex UI for beginners
Grafana Cloud
Managed observability stack with Grafana, Prometheus, Loki
Strengths
- Managed Prometheus and Loki
- Beautiful Grafana dashboards
Trade-offs
- Less comprehensive than Datadog/New Relic
- Requires some self-management
Dynatrace
AI-powered full-stack monitoring and AIOps platform
Strengths
- Advanced AI/ML for root cause analysis
- Automatic dependency mapping (Davis AI)
Trade-offs
- Complex setup for advanced features
- Vendor lock-in
Example stacks with Prometheus
Docs and release notes
Check Prometheus in your own stack
This page checks Prometheus in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.