GO-2026-5005 vulnerabilities

Vulnerabilities for packages: istio, loki, aactl, rancher, cloud-provider-aws, cilium, flux, helm, external-dns, snyk-cli, zot, kubernetes-dashboard, kubernetes, nerdctl, falco-no-driver, fscrypt, opentelemetry-collector, prometheus-operator, docker-cli-buildx, cert-manager, kine, buildah,...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: trivy, kaf, istio, loki, aactl, rancher, skaffold, chisel, gitea, kubescape, cloud-provider-aws, cilium, flux, docker-machine-driver-harvester, helm, external-dns, snyk-cli, zot, kubernetes-dashboard, kubernetes, nerdctl, falco-no-driver, osv-scanner, fscrypt,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-consul, argo-events, wire-go, aactl, amazon-cloudwatch-agent-operator, wgcf, kubernetes-dashboard-api, controller-gen, kubernetes-dashboard-auth, rclone, kapp, glow, rancher-system-upgrade-controller, swagger, flux, guac, delve, kyverno-notation-aws, zot,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, dbmate, aactl, kubernetes-csi-external-attacher, cosign, kapp, secrets-store-csi-driver-provider-gcp, lvm-driver, multus-cni, kyverno-notation-aws, chezmoi, cri-tools, kserve-modelmesh-serving, crossplane-provider-aws-firehose,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, dbmate, aactl, cosign, secrets-store-csi-driver-provider-gcp, glow, hivemind, secrets-store-csi-driver-provider-azure, multus-cni, grpc-health-probe, melange, chezmoi, cri-tools, kserve-modelmesh-serving, crossplane-provider-aws-firehose,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, wire-go, litestream, crossplane-provider-azure, aactl, wgcf, cosign, rclone, dynamic-localpv-provisioner, nri-prometheus, gke-gcloud-auth-plugin, glab, newrelic-prometheus-configurator, pombump, secrets-store-csi-driver-provider-gcp,...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...

UBUNTU-CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-73654 Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CLEANSTART-2026-AV59470 Security fixes in prometheus-node-exporter 1.12.1-r0

Package prometheus-node-exporter version 1.12.1-r0 fixes 1 vulnerabilities: CVE-2026-28735...

CLEANSTART-2026-GL72878 Security fixes in prometheus 3.13.1-r1

Package prometheus version 3.13.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-IU92725 Security fixes in prometheus-alertmanager 0.32.0-r0

Package prometheus-alertmanager version 0.32.0-r0 fixes 2 vulnerabilities: CVE-2026-39882, CVE-2026-39883...

CLEANSTART-2026-MN93701 Security fixes in prometheus-adapter 0.12.0-r1

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CLEANSTART-2026-ZO84411 Security fixes in prometheus-alertmanager 0.26.0-r0

Package prometheus-alertmanager version 0.26.0-r0 fixes 1 vulnerabilities: CVE-2023-40577...

CLEANSTART-2026-ZP59365 Security fixes in prometheus-alertmanager 0.32.0-r1

Package prometheus-alertmanager version 0.32.0-r1 fixes 19 vulnerabilities: CVE-2026-39835, CVE-2026-46598, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502...

CLEANSTART-2026-MW79791 Security fixes in prometheus 3.13.1-r2

Package prometheus version 3.13.1-r2 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw...

CVE-2026-67990: Cross-Site Request Forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

PT-2026-85964

Package prometheus version 3.13.1-r2 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...