CVE-2026-33387

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-1336

Published

2026-09-08

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

References

• https://security.nozominetworks.com/NN-2026:16-01
• https://cert-portal.siemens.com/productcert/html/ssa-911336.html

Check your stackJSON