CLEANSTART-2026-JQ93564 Security fixes in prometheus-pushgateway 1.9.0-r1

Package prometheus-pushgateway version 1.9.0-r1 fixes 24 vulnerabilities: CVE-2026-39835, CVE-2026-39828, CVE-2026-39829, CVE-2026-46597, CVE-2026-39830...

CLEANSTART-2026-DO56423 Security fixes in prometheus-statsd-exporter 0.29.0-r0

Package prometheus-statsd-exporter version 0.29.0-r0 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-NR19543 Security fixes in prometheus-fips 3.10.0-r1

Package prometheus-fips version 3.10.0-r1 fixes 3 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-2303, ghsa-259r-337f-4rfw...

CLEANSTART-2026-TA50699 Security fixes in prometheus-pushgateway-fips 1.11.3-r1

Package prometheus-pushgateway-fips version 1.11.3-r1 fixes 30 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-UW93671 Security fixes in prometheus-redis-exporter 1.88.0-r2

Package prometheus-redis-exporter version 1.88.0-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-KI63132 Security fixes in prometheus-fips 3.12.0-r1

Package prometheus-fips version 3.12.0-r1 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw...

CLEANSTART-2026-BQ51407 Security fixes in prometheus-pushgateway-fips 1.8.0-r1

Package prometheus-pushgateway-fips version 1.8.0-r1 fixes 30 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-SR41656 Security fixes in prometheus-mongodb-exporter-fips 0.53.0-r1

Package prometheus-mongodb-exporter-fips version 0.53.0-r1 fixes 12 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CLEANSTART-2026-WA17635 Security fixes in prometheus-pushgateway 1.10.0-r1

Package prometheus-pushgateway version 1.10.0-r1 fixes 4 vulnerabilities: CVE-2025-22868, CVE-2026-40179, CVE-2026-56852, CVE-2026-39824...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

EUVD-2026-66709

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

PT-2026-82280

Name of the Vulnerable Software and Affected Versions Static Web Server SWS versions prior to 2.44.0 Description Instances with both basic-auth and metrics features enabled process the '/metrics' endpoint before the basic-auth check in src/handler.rs. This allows an unauthenticated remote attacke...

SUSE SLES15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:3714-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3714-1 advisory. prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: CVE-2026-39821: Fix validation bypass and...

SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass an...

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: golang-github-prometheus-alertmanager: CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 bsc1266615 golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4: Security fixes:...