CVE-2026-22637

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...

CVE-2026-22637

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22637

...

CVE-2026-22637

CVE-2026-22637 is associated with Grafana XY Chart Plugin. The Red Hat entry and PT--security advisory describe a DOM-based XSS vulnerability where a user with Editor permissions can modify a panel to execute arbitrary JavaScript. Affected component: Grafana XY Chart Plugin; attack vector involve...

CVE-2026-22637

...

EUVD-2025-29514

Malicious code in bioql PyPI...

EUVD-2025-12371

Malicious code in bioql PyPI...

EUVD-2025-12376

Malicious code in bioql PyPI...

EUVD-2025-12232

Malicious code in bioql PyPI...

Malicious code in @zalastax/nolb-_xy (npm)

The package @zalastax/nolb-xy was found to contain malicious code...

MAL-2025-43103 Malicious code in @zalastax/nolb-_xy (npm)

The package @zalastax/nolb-xy was found to contain malicious code...

PT-2025-32598 · Maven · Org.Opensearch.Plugin:Opensearch-Security

Impact OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types ip, geo point, geo shape, xy point, xy shape. While the content of these fields is properly redacted in the source document returned by search operations, the original unredacted values remai...

The vulnerability of the data visualization plugin in the Grafana XY Chart Plugin system arises from the lack of security measures taken to protect the structure of the web page. This allows attackers to execute DOM-based XSS attacks.

The vulnerability of the data visualization plugin in the Grafana XY Chart Plugin exists due to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute a DOM-based XSS attack remotely...

CVE-2022-43704

The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol udp/1024 commands interfacing directly with the target device. This, in turn, allows for...

CVE-2025-29659

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

CVE-2025-29660

A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory...

BIT-GRAFANA-2025-2703

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...

SUSE CVE-2025-2703

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...

CVE-2025-2703

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...

CVE-2025-2703

CVE-2025-2703 affects Grafana’s built-in XY Chart plugin through a DOM XSS flaw. The advisory text states that a user with Editor permissions can modify a panel to execute arbitrary JavaScript, indicating that the vulnerability stems from client-side script handling in the chart component and cou...