ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

Security update for Prometheus

This update for Prometheus fixes the following issues: golang-github-prometheus-alertmanager, golang-github-prometheus-nodeexporter: Internal changes to fix build issues with no impact for customers golang-github-prometheus-prometheus: Security issues fixed: CVE-2026-27606: Fixed arbitrary file...

OPENSUSE-SU-2026:20177-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: Update to version 3.5.0: Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257329. - CVE-2025-12816: interpretation conflict...

SUSE-SU-2026:20232-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: Update to version 3.5.0: Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257329. - CVE-2025-12816: interpretation conflict...

Malicious code in angular-promql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34c3150aabe5f7147486dac3ab4fd22d906f4ec0d8f4f7d39b1c9f2137ebaaf The package angular-promql was found to contain malicious code...

EUVD-2025-200064

Malicious code in angular-promql npm...

MAL-2025-191505 Malicious code in angular-promql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34c3150aabe5f7147486dac3ab4fd22d906f4ec0d8f4f7d39b1c9f2137ebaaf The package angular-promql was found to contain malicious code...

Malicious code in ezer-promql-tree-viz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05504b5d2d9021afb1ee0c8ba55dc17f1d41a4f477637bddff24f2c0084b4749 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lezer-promql-tree-viz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75c995399e97f574eb4cc3e4484bfabc69554ee170fa58d38740ba5d058568d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ezer-promql-tree-viz

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in lezer-promql-tree-viz

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5912 Malicious code in ezer-promql-tree-viz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05504b5d2d9021afb1ee0c8ba55dc17f1d41a4f477637bddff24f2c0084b4749 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5933 Malicious code in lezer-promql-tree-viz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75c995399e97f574eb4cc3e4484bfabc69554ee170fa58d38740ba5d058568d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update golang-github-prometheus-prometheus

golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 jscPED-11649: Security issues fixed: CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling bsc1232970 Highlights of other changes: Performance: Significant enhancements to PromQL execution speed,...

SUSE-SU-2025:0546-1 Security update golang-github-prometheus-prometheus

golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 jscPED-11649: - Security issues fixed: CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling bsc1232970 - Highlights of other changes: Performance: + Significant enhancements to PromQL execution...

Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 jscPED-11649: Security issues fixed: CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error handling bsc1232970 Highlights of other changes: Performance: Significant...

SUSE-SU-2024:3288-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - Require Go 1.20 for building - Bump go-retryablehttp to version 0.7.7 CVE-2024-6104, bsc1227038 - Migrate from disabled to manual service mode - Add0003-Bump-go-retryablehttp.patch - Update to 2.45.6 jscPED-3577:...

Prometheus Sensitive Endpoint Detected

Prometheus is an open-source monitoring solution which is designed to record metrics in a dimensional data model to make it available through its own PromQL query language or built-in visualization capabilities. Prometheus offer multiple libraries named 'Exporters' to help exporting these endpoin...