CLEANSTART-2026-AT48963 Security fixes in keda-fips 2.19.0-r2

Package keda-fips version 2.19.0-r2 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...

CLEANSTART-2026-DY70483 Security fixes in metrics-server 0.8.1-r4

Package metrics-server version 0.8.1-r4 fixes 13 vulnerabilities: CVE-2026-33186, CVE-2026-42154, CVE-2026-39883, ghsa-hrxh-6v49-42gf, ghsa-p77j-4mvh-x3m3...

MiracleLinux 9 : opentelemetry-collector-0.152.1-1.el9_8 (AXSA:2026-1458:04)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1458:04 advisory. github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154...

CLEANSTART-2026-DP89496 Security fixes in elastic-beats 9.4.0-r1

Package elastic-beats version 9.4.0-r1 fixes 7 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, ghsa-fw8g-cg8f-9j28, ghsa-8rm2-7qqf-34qm...

CLEANSTART-2026-EO79692 Security fixes in prometheus-operator 0.69.1-r2

Package prometheus-operator version 0.69.1-r2 fixes 2 vulnerabilities: CVE-2026-42154, CVE-2026-46598...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-42154 vulnerabilities

Vulnerabilities for packages: ld-relay, opentelemetry-collector, opentelemetry-collector-fips, splunk-otel-collector, karma-fips, cloudzero-agent-fips, tempo-fips, minio-fips, trillian-fips, jaeger-fips, google-cloud-otel-ops-collector, amazon-cloudwatch-agent-operator, ld-relay-fips, grafana-fip...

UBUNTU-CVE-2026-42154

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a sma...