Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
{ "ubuntu_priority": "medium" }