CVE-2026-28380

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Any Editor could delete any snapshot, even if they have no access to read or write them.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
GrafanaGrafana OSS>= 9.4.0, <= 11.6.14; >= 11.6.14, < 11.6.14+security-04; >= 12.0.0, <= 12.2.8; >= 12.2.8, < 12.2.8+security-04; >= 12.3.0, <= 12.3.6; >= 12.3.6, < 12.3.6+security-04; >= 12.4.0, <= 12.4.3; >= 12.4.3, < 12.4.3+security-02; >= 13.0.0, <= 13.0.1; >= 13.0.1, < 13.0.1+security-01

References

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wrCVE-2026-283836.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An CVE-2026-283849.9An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commaCVE-2026-283855.0In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authCVE-2026-283867.5Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds CVE-2026-283878.1Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE CVE-2026-283887.5Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the reCVE-2026-283897.5Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. ICVE-2026-283907.5Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happenCVE-2026-283919.8OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default cCVE-2026-283929.8OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorCVE-2026-283939.8OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitra
CVE-2026-28380: Medium severity, CVSS 6.5 | Vulnix