Most recent entries from all

bdu:2026-10839

BIT-grafana-2026-9029 — Stored XSS in the Geomap panel tile-layer attribution

Affected: Bitnami: grafana

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

EUVD-2026-360199

fkie_cve-2026-9029

GHSA-9g84-39mm-q4p3 — Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug

Affected: Go: github.com/grafana/grafana

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix

openSUSE-SU-2026:11619-1 — grafana-12.4.5-4.1 on GA media

grafana-12.4.5-4.1 on GA media

RHSA-2026:67573 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization joi: joi: Prototype Pollution via custom messages

UBUNTU-CVE-2026-9029

Affected: Ubuntu:16.04:LTS: grafana