GHSA-VFFH-X6R8-XX99 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

PT-2026-32579

Name of the Vulnerable Software and Affected Versions Prometheus versions 3.0 through 3.5.1 Prometheus versions 3.6.0 through 3.11.1 Description Stored cross-site scripting exists in multiple components of the Prometheus web UI, specifically within the Mantine UI and the old React UI. The issue...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kyverno, go-discover, cloud-provider-aws, dbmate, spire-server, pguser, nri-haproxy, gitlab-pages, dive, step-issuer, policy-controller, lvm-driver, nfs-subdir-external-provisioner, zot, kubernetes-csi-driver-hostpath, kbld, aactl, local-path-provisioner,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth, go-discover, apko, k3s, kyverno, litestream, libnvidia-container, cloud-provider-aws, vault-secrets-webhook, wal-g, swagger, eksctl, dbmate, spire-server, sriov-network-device-plugin, grafana-mimir, filebrowser, certificate-transparency,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kyverno, go-discover, cloud-provider-aws, dbmate, spire-server, pguser, nri-haproxy, gitlab-pages, dive, step-issuer, policy-controller, lvm-driver, nfs-subdir-external-provisioner, zot, kbld, aactl, local-path-provisioner, kube-logging-operator-custom-runner,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth, go-discover, apko, k3s, kyverno, litestream, libnvidia-container, cloud-provider-aws, vault-secrets-webhook, wal-g, swagger, eksctl, dbmate, spire-server, sriov-network-device-plugin, grafana-mimir, filebrowser, certificate-transparency,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kyverno, go-discover, cloud-provider-aws, dbmate, spire-server, pguser, nri-haproxy, gitlab-pages, dive, step-issuer, policy-controller, lvm-driver, nfs-subdir-external-provisioner, zot, kbld, aactl, local-path-provisioner, kube-logging-operator-custom-runner,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: conftest-fips, cloudflared-fips, docker-cli-buildx, cilium-envoy-fips, step-ca, nats, argo-cd-fips, kyverno-fips, kubernetes, terraform-fips, spegel, docker-compose-fips, oras, prometheus-podman-exporter-fips, gitlab-workhorse-ce-fips, cephcsi-fips,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: crossplane-function-environment-configs, eks-node-monitoring-agent, conftest-fips, db-operator, terraform-provider-azapi, crossplane-provider-aws-s3-fips, amazon-cloudwatch-agent-operator, cloudflared-fips, docker-cli-buildx, tetragon-fips, cue-fips, authservice,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: conftest-fips, cloudflared-fips, docker-cli-buildx, cilium-envoy-fips, step-ca, nats, argo-cd-fips, kyverno-fips, kubernetes, terraform-fips, spegel, docker-compose-fips, oras, prometheus-podman-exporter-fips, gitlab-workhorse-ce-fips, cephcsi-fips,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: crossplane-function-environment-configs, eks-node-monitoring-agent, conftest-fips, db-operator, terraform-provider-azapi, crossplane-provider-aws-s3-fips, amazon-cloudwatch-agent-operator, cloudflared-fips, docker-cli-buildx, tetragon-fips, cue-fips, authservice,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: mongo-tools, kubectx, crossplane-function-environment-configs, eks-node-monitoring-agent, clickhouse-operator, nri-discovery-kubernetes, conftest-fips, pvc-autoresizer, terraform-provider-tls-fips, db-operator, terraform-provider-azapi, crossplane-provider-aws-s3-fip...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: mongo-tools, kubectx, crossplane-function-environment-configs, eks-node-monitoring-agent, clickhouse-operator, nri-discovery-kubernetes, conftest-fips, pvc-autoresizer, terraform-provider-tls-fips, amazon-k8s-cni, db-operator, terraform-provider-azapi,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: mongo-tools, kubectx, crossplane-function-environment-configs, eks-node-monitoring-agent, clickhouse-operator, nri-discovery-kubernetes, conftest-fips, pvc-autoresizer, terraform-provider-tls-fips, amazon-k8s-cni, db-operator, terraform-provider-azapi,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: mongo-tools, kubectx, crossplane-function-environment-configs, eks-node-monitoring-agent, clickhouse-operator, nri-discovery-kubernetes, conftest-fips, pvc-autoresizer, terraform-provider-tls-fips, db-operator, terraform-provider-azapi, crossplane-provider-aws-s3-fip...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: crossplane-function-environment-configs, terraform-provider-azapi, amazon-cloudwatch-agent-operator, cloudflared-fips, yace, docker-cli-buildx, authservice, grafana-pyroscope, spicedb-operator, aws-eks-pod-identity-agent, prometheus-snmp-exporter, spilo,...

CLEANSTART-2026-JT73156 protojson

Multiple security vulnerabilities affect the prometheus-node-exporter package. The protojson. See references for individual vulnerability details...

CLEANSTART-2026-DK61762 filippo

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. filippo. See references for individual vulnerability details...

CLEANSTART-2026-AR20742 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-RI97043 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...