Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
{ "binaries": [ { "binary_name": "grafana", "binary_version": "2.6.0+dfsg-1" }, { "binary_name": "grafana-data", "binary_version": "2.6.0+dfsg-1" } ] }