{"id":"EUVD-2026-38243","revision":"f9edebdc916a480497b059c454e12149","records":[{"revision":"f9edebdc916a480497b059c454e12149","observedAt":"2026-10-28T10:35:46.411+00:00","statement":{"source":"euvd","id":"EUVD-2026-38243","aliases":["CVE-2026-9029","GHSA-9g84-39mm-q4p3"],"title":"A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cr…","description":"A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","score":7.3,"severity":null}],"references":["https://grafana.com/security/security-advisories/cve-2026-9029"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38243","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 22, 2026, 1:18:40 PM","dateUpdated":"Aug 27, 2026, 5:22:27 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:4600-1","title":"Security update for grafana, system-user-grafana","vulnerabilityIds":["CVE-2026-1229","CVE-2026-14199","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-33814","CVE-2026-39882","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-56852","CVE-2026-73501","CVE-2026-8595","CVE-2026-8609","CVE-2026-9029"]},{"id":"openSUSE-SU-2026:11619-1","title":"grafana-12.4.5-4.1 on GA media","vulnerabilityIds":["CVE-2026-1229","CVE-2026-21723","CVE-2026-33814","CVE-2026-39882","CVE-2026-8609","CVE-2026-9029"]},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2023-45289","CVE-2024-22195","CVE-2025-13836","CVE-2025-4673","CVE-2025-61686","CVE-2026-0864","CVE-2026-11940","CVE-2026-11972","CVE-2026-1229","CVE-2026-13346","CVE-2026-14199","CVE-2026-1502","CVE-2026-15308","CVE-2026-1703","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-27459","CVE-2026-3219","CVE-2026-3276","CVE-2026-33814","CVE-2026-3446","CVE-2026-3479","CVE-2026-39821","CVE-2026-39882","CVE-2026-40181","CVE-2026-40475","CVE-2026-41066","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-42211","CVE-2026-42342","CVE-2026-4360","CVE-2026-44431","CVE-2026-44990","CVE-2026-45409","CVE-2026-4786","CVE-2026-49825","CVE-2026-49853","CVE-2026-49854","CVE-2026-49855","CVE-2026-53606","CVE-2026-56852","CVE-2026-6019","CVE-2026-6100","CVE-2026-6357","CVE-2026-7210","CVE-2026-73501","CVE-2026-7774","CVE-2026-8328","CVE-2026-8595","CVE-2026-8609","CVE-2026-8643","CVE-2026-9029"]},{"id":"RHSA-2026:67605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-9029","CVE-2026-10601","CVE-2026-61709","CVE-2026-90771"]},{"id":"RHSA-2026:68143","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-9029","CVE-2026-10601","CVE-2026-86472"]},{"id":"RHSA-2026:67573","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-9029","CVE-2026-10601","CVE-2026-75838","CVE-2026-90771"]},{"id":"openSUSE-SU-2026:22125-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2026-1229","CVE-2026-14199","CVE-2026-17033","CVE-2026-17183","CVE-2026-19197","CVE-2026-19475","CVE-2026-21723","CVE-2026-2303","CVE-2026-33814","CVE-2026-39882","CVE-2026-41178","CVE-2026-41606","CVE-2026-42127","CVE-2026-56852","CVE-2026-73501","CVE-2026-8609","CVE-2026-9029"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38243","identifiers":["EUVD-2026-38243","CVE-2026-9029","GHSA-9g84-39mm-q4p3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}