https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:28:07.301039+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:4682 ALSA-2020:4682 — Moderate: grafana security, bug fix, and enhancement update 2026-10-03T17:28:07.418286+00:00

Affected: AlmaLinux:8: grafana, AlmaLinux:8: grafana-azure-monitor, AlmaLinux:8: grafana-cloudwatch, AlmaLinux:8: grafana-elasticsearch, AlmaLinux:8: grafana-graphite, AlmaLinux:8: grafana-influxdb, AlmaLinux:8: grafana-loki, AlmaLinux:8: grafana-mssql, AlmaLinux:8: grafana-mysql, AlmaLinux:8: grafana-opentsdb and 3 more

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

* grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)

* grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

* grafana: stored XSS (CVE-2020-11110)

* grafana: XSS annotation popup vulnerability (CVE-2020-12052)

* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

* grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

* grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

* grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bit-grafana-2020-11110 BIT-grafana-2020-11110 2026-10-03T17:28:07.418375+00:00

Affected: Bitnami: grafana

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

 https://cve.radiocsirt.org/vuln/euvd-2026-40387 EUVD-2026-40387 2026-10-03T17:28:07.418400+00:00 EUVD-2026-40387 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11110 fkie_cve-2020-11110 2026-10-03T17:28:07.418414+00:00

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

 https://cve.radiocsirt.org/vuln/ghsa-xr3x-62qw-vc4w GHSA-xr3x-62qw-vc4w — Grafana stored XSS 2026-10-03T17:28:07.418437+00:00

Affected: Go: github.com/grafana/grafana

Grafana through 6.7.1 allows stored XSS.

 https://cve.radiocsirt.org/vuln/gsd-2020-11110 gsd-2020-11110 2026-10-03T17:28:07.418456+00:00 gsd-2020-11110 https://cve.radiocsirt.org/vuln/rhsa-2020:4298 RHSA-2020:4298 — Red Hat Security Advisory: OpenShift Container Platform 4.6.1 image security update 2026-10-03T17:28:07.418467+00:00

SSL/TLS: CBC padding timing attack (lucky-13) grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser nodejs-lodash: prototype pollution in zipObjectDeep function kubernetes: compromised node could escalate to cluster level privileges golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic openshift/console: text injection on error page via crafted url kibana: X-Frame-Option not set by default might lead to clickjacking jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods grafana: stored XSS grafana: XSS annotation popup vulnerability grafana: XSS via column.title or cellLinkTooltip nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash open…

 https://cve.radiocsirt.org/vuln/rhsa-2020:4682 RHSA-2020:4682 — Red Hat Security Advisory: grafana security, bug fix, and enhancement update 2026-10-03T17:28:07.418537+00:00

grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen grafana: arbitrary file read via MySQL data source grafana: stored XSS grafana: XSS annotation popup vulnerability grafana: XSS via column.title or cellLinkTooltip grafana: information disclosure through world-readable /var/lib/grafana/grafana.db grafana: information disclosure through world-readable grafana configuration files grafana: XSS via the OpenTSDB datasource

 https://cve.radiocsirt.org/vuln/suse-su-2020:2715-1 SUSE-SU-2020:2715-1 — Security update for grafana 2026-10-03T17:28:07.418567+00:00

Security update for grafana

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-11110 UBUNTU-CVE-2020-11110 2026-10-03T17:28:07.418582+00:00

Affected: Ubuntu:16.04:LTS: grafana

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.