SUSE: Security Advisory (SUSE-SU-2026:20574-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 42 Update: prometheus-3.10.0-1.fc42

The Prometheus monitoring system and time series database...

[SECURITY] Fedora 43 Update: prometheus-3.10.0-1.fc43

The Prometheus monitoring system and time series database...

Fedora 42 : prometheus (2026-c9fb6d2b76)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c9fb6d2b76 advisory. Rename from golang-github-prometheus and upgrade to 3.10.0 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 43 : prometheus (2026-ce1dd0caa0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce1dd0caa0 advisory. Rename from golang-github-prometheus & update to 3.10.0 Tenable has extracted the preceding description block directly from the Fedora security...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality (CVE-2025-13490)

Summary When an IBM App Connect Enterprise Certified Container IntegrationRuntime or IntegrationServer is configured to report metrics to a Prometheus instance in the OpenShift cluster, the metrics are sent over an unencrypted channel. This bulletin provides patch information to address the...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kong-ingress-controller, ansible-operator-fips, kubernetes-csi-external-snapshotter, ratify, flux-source-controller-fips, blob-csi, docker-compose-fips, syft-fips, kyverno-policy-reporter-plugins-kyverno, k6-operator-fips, percona-server-mongodb-operator-fips, cerbos...

CLEANSTART-2026-XZ04425 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.0 release

Red Hat build of OpenTelemetry 3.9.0 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: The deprecated OpenCensus Receiver, which provided backward compatibility with the OpenCensus project for easier...

SUSE-SU-2026:0626-1 Security update 5.1.2 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Non-customer-facing optimization around source building golang-github-lusitaniae-apacheexporter: - Build without apparmor for openSUSE Leap 16, SLES 16 or newer - Require Go 1.23 for building - Update to versi...

CLEANSTART-2026-RD09851 net/url package does not set a limit on the number of query parameters in a query

Multiple security vulnerabilities affect the prometheus-operator package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.3.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: temporal-server, kyverno-policy-reporter-fips, step, witness, rekor, beats, juicefs, ratify, flux-kustomize-controller-fips, elastic-agent-fips, sops-fips, kine, tkn, mattermost-fips, sqlexporter-fips, ory-kratos, step-kms-plugin, envoy-gateway, fulcio-fips, sftpgo,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: ratify, rekor, ksops, mariadb-operator, hydra, sops, step-ca, temporal, chezmoi, step-kms-plugin, kyverno-policy-reporter, juicefs, sqlexporter, witness, argo-workflows, kots, sftpgo-plugin-eventstore, keda, tkn, nuclei, trufflehog, sftpgo, croc, openbao,...

openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20239-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20239-1 advisory. - CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. bsc1257841 - CVE-2026-1615: Fixed...

Security update for golang-github-prometheus-prometheus (critical)

openSUSE security update: security update for golang-github-prometheus-prometheus ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20239-1 Rating: critical References: bsc1257442 bsc1257841 bsc1257897 Cross-References: CVE-2025-61140 CVE-2026-1615...

SUSE-SU-2026:20574-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. bsc1257841 - CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Pat...

CVE-2026-26069

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

CLEANSTART-2026-TR92727 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the prometheus-operator-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should ha...

CLEANSTART-2026-JB30245 Security fixes for GHSA-F6X5-JH6R-WRFV, GHSA-J5W8-Q4QC-RX2X applied in versions: 0.47.2-r0

Multiple security vulnerabilities affect the prometheus-mongodb-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...