https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:39:18.937914+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10839 bdu:2026-10839 2026-10-02T22:39:19.078661+00:00 bdu:2026-10839 https://cve.radiocsirt.org/vuln/bit-grafana-2026-9029 BIT-grafana-2026-9029 — Stored XSS in the Geomap panel tile-layer attribution 2026-10-02T22:39:19.078709+00:00

Affected: Bitnami: grafana

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

 https://cve.radiocsirt.org/vuln/euvd-2026-360199 EUVD-2026-360199 2026-10-02T22:39:19.078748+00:00 EUVD-2026-360199 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9029 fkie_cve-2026-9029 2026-10-02T22:39:19.078762+00:00

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

 https://cve.radiocsirt.org/vuln/ghsa-9g84-39mm-q4p3 GHSA-9g84-39mm-q4p3 — Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug 2026-10-02T22:39:19.078786+00:00

Affected: Go: github.com/grafana/grafana

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11619-1 openSUSE-SU-2026:11619-1 — grafana-12.4.5-4.1 on GA media 2026-10-02T22:39:19.078814+00:00

grafana-12.4.5-4.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:67573 RHSA-2026:67573 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T22:39:19.078837+00:00

grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization joi: joi: Prototype Pollution via custom messages

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9029 UBUNTU-CVE-2026-9029 2026-10-02T22:39:19.078860+00:00

Affected: Ubuntu:16.04:LTS: grafana

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).