https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:06:41.906238+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:7519 ALSA-2022:7519 — Moderate: grafana security, bug fix, and enhancement update 2026-10-02T16:06:42.144468+00:00

Affected: AlmaLinux:8: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * grafana: XSS vulnerability in data source handling (CVE-2022-21702) * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703) * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including…

 https://cve.radiocsirt.org/vuln/bdu:2023-02415 bdu:2023-02415 2026-10-02T16:06:42.144543+00:00 bdu:2023-02415 https://cve.radiocsirt.org/vuln/bit-grafana-2022-21702 BIT-grafana-2022-21702 — Cross site scripting in Grafana proxy 2026-10-02T16:06:42.144561+00:00

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/cnvd-2022-28802 cnvd-2022-28802 2026-10-02T16:06:42.144591+00:00 cnvd-2022-28802 https://cve.radiocsirt.org/vuln/euvd-2026-232801 EUVD-2026-232801 2026-10-02T16:06:42.144604+00:00 EUVD-2026-232801 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21702 fkie_cve-2022-21702 2026-10-02T16:06:42.144614+00:00

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-xc3p-28hw-q24g GHSA-xc3p-28hw-q24g — Grafana proxy Cross-site Scripting 2026-10-02T16:06:42.144642+00:00

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana.

Release v.8.3.5, only containing security fixes:

- [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/)

Release v.7.5.15, only containing security fixes:

- [Download Grafana 7.5.15](https://grafana.com/grafana/download/7.5.15) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-15/)

## XSS ([CVE-2022-21702](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21702))

### Summary

On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources.

An attacker could serve HTML content through the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance.

We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).

### Impact

Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same…

 https://cve.radiocsirt.org/vuln/gsd-2022-21702 gsd-2022-21702 2026-10-02T16:06:42.144709+00:00 gsd-2022-21702 https://cve.radiocsirt.org/vuln/oesa-2022-1599 OESA-2022-1599 — grafana security update 2026-10-02T16:06:42.144723+00:00

Affected: openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana, openEuler:20.03-LTS-SP3: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB and OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11836-1 openSUSE-SU-2024:11836-1 — grafana-8.3.5-1.1 on GA media 2026-10-02T16:06:42.144758+00:00

grafana-8.3.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 SUSE-FU-2022:1419-1 — Feature update for grafana 2026-10-02T16:06:42.144776+00:00

Feature update for grafana

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21702 UBUNTU-CVE-2022-21702 2026-10-02T16:06:42.144795+00:00

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0407 WID-SEC-W-2022-0407 — Grafana: Mehrere Schwachstellen 2026-10-02T16:06:42.144818+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Administratorrechte zu erlangen und um Informationen offenzulegen.