6.8
Moyenne
CVE-2025-2703 The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability
Description
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana 11.6 | premières → < 11.6.0+security-01 | 11.6.0+security-01 |
| grafana 11.5 | 11.5.0 → < 11.5.3+security-01 | 11.5.3+security-01 |
| grafana 11.4 | 11.4.0 → < 11.4.3+security-01 | 11.4.3+security-01 |
| grafana 11.3 | 11.3.0 → < 11.3.5+security-01 | 11.3.5+security-01 |
| grafana 11.2 | 11.2.0 → < 11.2.8+security-01 | 11.2.8+security-01 |
| Grafana Enterprise 11.6 | premières → < 11.6.0+security-01 | 11.6.0+security-01 |
| Grafana Enterprise 11.5 | 11.5.0 → < 11.5.3+security-01 | 11.5.3+security-01 |
| Grafana Enterprise 11.4 | 11.4.0 → < 11.4.3+security-01 | 11.4.3+security-01 |
| Grafana Enterprise 11.3 | 11.3.0 → < 11.3.5+security-01 | 11.3.5+security-01 |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Grafana Enterprise 11.2 | 11.2.0 → < 11.2.8+security-01 | 11.2.8+security-01 |
Autres CVE de grafana
Les 59 CVE de grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Moyenne
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critique
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
Élevée