Skip to content
OpenAdvisories
High RHSA-2026:73655 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 1, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.6-0.5.hum1

Vulnerabilities 3

  • High 7.3
    CVE-2026-76154

    CVE-2026-76154 CVE Record

    A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • Medium 4.7
    CVE-2026-93981

    hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

    hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to rend…

    honojs hono hono npm
  • Medium 4.3
    CVE-2026-81842

    Library panel can be moved into a folder without library panel create permission

    An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel c…

    Grafana Grafana OSS Grafana Enterprise grafana-12.3 Web / CMS Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-93981
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-81842
  • report
    https://access.redhat.com/security/cve/CVE-2026-76154
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73655.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528028
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-76154
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-76154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2543653
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-81842
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-81842
  • article
    https://grafana.com/security/security-advisories/cve-2026-81842
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538284
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93981
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93981
  • article
    https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv
  • article
    https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings