CVE catalog
CVE-2026-21722
UBUNTU-CVE-2026-21722
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.36% · Oct 25, 2026
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | grafana | 16.04 | 2.6.0+dfsg-1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20654-1.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-21722]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21722.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]