Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
{ "binaries": [ { "binary_name": "grafana", "binary_version": "2.6.0+dfsg-1" }, { "binary_name": "grafana-data", "binary_version": "2.6.0+dfsg-1" } ] }