CVE and update status of the FreeBSD ports tree3,534 unaddressed CVEs in 701 portsAll times are CET
CVE details

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

Score
6.5 medium
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/grafanagrafana13.1.1_5unaddresseddrtr0jan@yandex.ru

Template for a VuXML entry

This generator is not reliable at the moment

Package names, ranges and the XML itself can be wrong. Always check the content before you commit it, and run make validate in security/vuxml. The generator is being rewritten from scratch.

Range per package from the CVE record, for ports with a version line in their name (python312) only from that line. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>grafana</name>
	<!-- no fixed version in the CVE record -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A user with the Viewer role in Grafana can crash the server by
	  submitting a crafted server-side math expression (uncontrolled
	  recursion). A user with permission to provision alert rules can make
	  the outage persist across restarts.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-88858</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-88858</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>