CVE-2026-21722

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

This did not leak any annotations that would not otherwise be visible on the public dashboard.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-217235.3The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limit CVE-2026-217244.3A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Ed CVE-2026-217252.0A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to CVE-2026-217265.3The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an atta CVE-2026-217273.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward c CVE-2026-217287.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploy CVE-2026-217297.5Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploym CVE-2026-21739.8A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f CVE-2026-217306.1Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote at CVE-2026-217329.6A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217337.3Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-217347.7A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i