CVE-2026-9029

MediumCVSS 5.4/10Last modified Jul 10, 2026

Description

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2026
Last modified
Jul 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-90290In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported CVE-2026-902917.8In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The CVE-2026-902927.8In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up theCVE-2026-902937.5In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registratCVE-2026-902947.5In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registereCVE-2026-90295In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imxCVE-2026-90296In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6_soc_CVE-2026-90297In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4i_crtc_init(CVE-2026-90298In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference of_find_device_by_nodeCVE-2026-90299In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIG_FUNCTION_ERRCVE-2026-90306.8A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd dCVE-2026-90300In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in __bpf_get_task_stack Both bpf_get_task_stac
CVE-2026-9029: Medium severity, CVSS 5.4 | Vulnix