CLEANSTART-2026-OT08451 Security fix for CVE-2026-40898 applied in: kube-metrics-adapter 0.2.9-r0, kubernetes-dns-node-cache 1.23.1-r0, kubernetes-dns-node-cache 1.24.1-r1, kubernetes-dns-node-cache 1.25.0-r8, kubernetes-dns-node-cache 1.26.0-r1, prometheus-blackbox-exporter 0.28.0-r2

CVE-2026-40898 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FX37210 Security fix for CVE-2026-42306 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, rancher-agent 2.11.15-r1, vault 1.19.5-r1

CVE-2026-42306 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AC15686 Security fix for CVE-2026-41567 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, rancher-agent 2.11.15-r1

CVE-2026-41567 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YU49777 Security fix for CVE-2026-28735 applied in: prometheus-node-exporter 1.10.2-r3, prometheus-node-exporter 1.11.1-r2, prometheus-node-exporter 1.12.1-r0, prometheus-node-exporter 1.9.1-r3

CVE-2026-28735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PM97219 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-PX77651 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the prometheus-alertmanager package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

CLEANSTART-2026-GE74044 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. S...

CLEANSTART-2026-OE08543 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

AZL-101079 CVE-2026-84445 affecting package prometheus-adapter 0.12.0-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging broker. In rabbitMQ-server prior to version 3.8.17, adding a new user through the management UI could result in the user’s banner being displayed in a confirmation message without proper tag sanitization, potentially allowing JavaScript code to execute withi...

Astra Linux – Vulnerability in golang-github-prometheus-client-golang

clientgolang is the instrumentation library for Go applications in Prometheus. The promhttp package within clientgolang provides tools for working with HTTP servers and clients. Prior to version 1.11.1 of clientgolang, HTTP servers were vulnerable to Denial of Service attacks due to unbounded...

CLEANSTART-2026-DB46993 Prometheus is an open-source monitoring system and time series database

Multiple security vulnerabilities affect the prometheus-operator package. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-LE73008 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the prometheus-redis-exporter package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

AZL-100944 CVE-2026-83530 affecting package prometheus-adapter 0.12.0-10

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.11.0 release

Red Hat build of OpenTelemetry 3.11.0 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: With this update, the addmetricsuffixes field of the Prometheus Exporter configuration in the...

suricata_exporter v0.6.0

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...

Linux Distros Unpatched Vulnerability : CVE-2026-80220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - prometheus-postgres-exporter - None Ubuntu Linux - Unknown description CVE-2026-80220 Note that Nessus relies on the presence of the package as...

AZL-99333 CVE-2026-84304 affecting package prometheus-adapter 0.12.0-9

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CLEANSTART-2026-BP74868 Security fixes in prometheus-pushgateway-fips 1.8.0-r2

Package prometheus-pushgateway-fips version 1.8.0-r2 fixes 28 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...