https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:46:52 +0000 https://vulnerability.circl.lu/vuln/bit-grafana-2026-76154 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> https://vulnerability.circl.lu/vuln/bit-grafana-2026-76154 https://vulnerability.circl.lu/vuln/fkie_cve-2026-76154 <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-76154 https://vulnerability.circl.lu/vuln/ghsa-35gc-393c-vjxf <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> <p>A stored cross-site scripting vulnerability in the Geomap panel&#39;s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user&#39;s session by hosting a malicious style configuration, enabling escalation to Org Admin.</p> https://vulnerability.circl.lu/vuln/ghsa-35gc-393c-vjxf https://vulnerability.circl.lu/vuln/opensuse-su-2026:11920-1 <p>grafana-12.4.11-1.1 on GA media</p> <p>grafana-12.4.11-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11920-1 https://vulnerability.circl.lu/vuln/rhsa-2026:73655 <p>grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation grafana: grafana: Authorization bypass via missing destination folder permission check hono: hono/jsx: Cross-Site Scripting via Unescaped Strings</p> <p>grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation grafana: grafana: Authorization bypass via missing destination folder permission check hono: hono/jsx: Cross-Site Scripting via Unescaped Strings</p> https://vulnerability.circl.lu/vuln/rhsa-2026:73655