https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T01:09:57.970254+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-03177 bdu:2026-03177 2026-10-23T01:09:57.973668+00:00 bdu:2026-03177 https://cve.radiocsirt.org/vuln/euvd-2026-275863 EUVD-2026-275863 2026-10-23T01:09:57.973713+00:00 EUVD-2026-275863 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32117 fkie_cve-2026-32117 2026-10-23T01:09:57.973740+00:00

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.