CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3

CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3. A patched version of the package is available...

CVE-2024-51744 affecting package prometheus for versions less than 2.37.9-4

CVE-2024-51744 affecting package prometheus for versions less than 2.37.9-4. A patched version of the package is available...

GHSA-3QJF-QH38-X73V Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Impact An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICSCOLLECTOR configuration option is enabled and METRICSALLOWEDNETWORKS is set to 127.0.0.1/8 the default. Patches PR 1745 fixes the problem. Available in Miniflux = 2.0.43...

Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Impact An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICSCOLLECTOR configuration option is enabled and METRICSALLOWEDNETWORKS is set to 127.0.0.1/8 the default. Patches PR 1745 fixes the problem. Available in Miniflux = 2.0.43...

CVE-2025-30204 affecting package prometheus for versions less than 2.37.9-3

CVE-2025-30204 affecting package prometheus for versions less than 2.37.9-3. A patched version of the package is available...

CVE-2025-30204 affecting package prometheus for versions less than 2.45.4-9

CVE-2025-30204 affecting package prometheus for versions less than 2.45.4-9. A patched version of the package is available...

CVE-2025-30219

A flaw was found in the RabbitMQ package. Affected versions of RabbitMQ are vulnerable to an attack that can modify the virtual host name on the disk and then make it unrecoverable, with other on disk file modifications. This issue can lead to arbitrary JavaScript code execution in the browsers o...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: bank-vaults, openbao, rclone, vexctl, zot, sops, kubescape, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, timestamp-authority, terraform-provider-azurerm, splunk-otel-collector, flux, fluent-bit-plugin-loki, secrets-store-csi-driver-provider-azure,...

AZL-59229 CVE-2025-30204 affecting package prometheus for versions less than 2.37.9-3

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-59162 CVE-2025-30204 affecting package prometheus for versions less than 2.45.4-10

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2019-3826 vulnerabilities

Vulnerabilities for packages: prometheus, istio-fips, grafana, node-problem-detector-fips...

GHSA-3M87-5598-2V4F vulnerabilities

Vulnerabilities for packages: prometheus, istio-fips, grafana, node-problem-detector-fips...

CVE-2025-22868 affecting package prometheus for versions less than 2.45.4-8

CVE-2025-22868 affecting package prometheus for versions less than 2.45.4-8. A patched version of the package is available...

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: syft-fips, crossplane-provider-aws-memorydb, crossplane-provider-aws-sqs, fulcio, kube-logging-logging-operator, neuvector, trivy-fips, crossplane-provider-aws-eks, cert-exporter-fips, amazon-ssm-agent, cilium-envoy-fips, terraform, crossplane-provider-sql,...

AZL-58413 CVE-2025-22870 affecting package prometheus-process-exporter for versions less than 0.8.2-2

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58472 CVE-2025-22870 affecting package prometheus for versions less than 2.45.4-12

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58422 CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

Linux Distros Unpatched Vulnerability : CVE-2022-21698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and...

Linux Distros Unpatched Vulnerability : CVE-2022-46146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and...