CVE-2026-76154

HighCVSS 7.3/10Last modified Sep 18, 2026

Description

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Grafana	Grafana OSS	12.3.0; >= 12.4.0, <= 12.4.10; >= 13.0.0, <= 13.0.8; >= 13.1.0, <= 13.1.5; >= 13.2.0, <= 13.2.1
Grafana	Grafana Enterprise	12.3.0; >= 12.4.0, <= 12.4.10; >= 13.0.0, <= 13.0.8; >= 13.1.0, <= 13.1.5; >= 13.2.0, <= 13.2.1

References

https://grafana.com/security/security-advisories/cve-2026-76154

Timeline

Published: Sep 17, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-761559.3Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative acce CVE-2026-761569.4OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator CVE-2026-761578.8Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allow CVE-2026-761589.3External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remot CVE-2026-761597.0Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows CVE-2026-76164.3The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due t CVE-2026-761637.5If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may CVE-2026-761647.1AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenti CVE-2026-761664.3A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a v CVE-2026-761689.8In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transvers CVE-2026-761697.5fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a diff CVE-2026-76175.3The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7. This is due to the