CLEANSTART-2026-TR92727 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the prometheus-operator-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should ha...

CLEANSTART-2026-JB30245 Security fixes for GHSA-F6X5-JH6R-WRFV, GHSA-J5W8-Q4QC-RX2X applied in versions: 0.47.2-r0

Multiple security vulnerabilities affect the prometheus-mongodb-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...

SUSE: Security Advisory (SUSE-SU-2026:20232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-26069

Scraparr (Prometheus Exporter) prior to 3.0.2 is affected when Readarr integration is enabled and the exporter’s /metrics is exposed to outsiders. The Readarr API key could be exposed as the alias metric label value, under conditions: Readarr scraping enabled, no alias configured, /metrics public...

CVE-2026-26069 Scraparr Readarr Integration exposes sensitive values as metric labels.

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

CVE-2026-26069

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

CVE-2026-26069: Exposure of Sensitive Information to an Unauthorized Actor

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

[SECURITY] Fedora 42 Update: rust-monitord-exporter-0.4.1-8.fc42

monitord-exporter is a Prometheus exporter using monitord to export statistic to Prometheus collectors...

CLEANSTART-2026-LS08172 Within HostnameError

Multiple security vulnerabilities affect the prometheus-fips package. Within HostnameError. See references for individual vulnerability details...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, karma, harbor-registry, s5cmd, sonobuoy, hydra, nsc, traefik, step-ca, authservice, gptscript, gcsfuse, grafana, otel-cli, sftpgo-plugin-eventstore, osv-scanner, crossplane-provider-aws-iam, skaffold, mattermost,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: age, grafana-mimir, git-lfs, gitness, karma, mkcert, harbor-registry, go-bindata, s5cmd, sonobuoy, hydra, nsc, traefik, step-ca, authservice, gptscript, gcsfuse, grafana, otel-cli, sftpgo-plugin-eventstore, osv-scanner, crossplane-provider-aws-iam, skaffold,...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, karma, harbor-registry, s5cmd, sonobuoy, hydra, nsc, traefik, step-ca, authservice, gptscript, gcsfuse, grafana, otel-cli, sftpgo-plugin-eventstore, osv-scanner, crossplane-provider-aws-iam, skaffold, mattermost,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: age, grafana-mimir, git-lfs, gitness, karma, mkcert, harbor-registry, go-bindata, s5cmd, sonobuoy, hydra, nsc, traefik, step-ca, authservice, gptscript, gcsfuse, grafana, otel-cli, sftpgo-plugin-eventstore, osv-scanner, crossplane-provider-aws-iam, skaffold,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: longhorn-cli, victoriametrics-operator, kubernetes-event-exporter, velero-plugin-for-microsoft-azure-fips, metrics-server, oras-fips, zabbix-agent2, rancher-webhook-fips, wuzz, cert-manager-cmctl, chaos-mesh-fips, crossplane-provider-aws-sns-fips, logstash-exporter,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: longhorn-cli, victoriametrics-operator, kubernetes-event-exporter, velero-plugin-for-microsoft-azure-fips, metrics-server, oras-fips, zabbix-agent2, rancher-webhook-fips, wuzz, cert-manager-cmctl, chaos-mesh-fips, crossplane-provider-aws-sns-fips, logstash-exporter,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: longhorn-cli, victoriametrics-operator, kubernetes-event-exporter, metrics-server, oras-fips, zabbix-agent2, rancher-webhook-fips, wuzz, cert-manager-cmctl, chaos-mesh-fips, crossplane-provider-aws-sns-fips, logstash-exporter, neuvector,...

[SECURITY] Fedora 43 Update: rust-monitord-exporter-0.4.1-8.fc43

monitord-exporter is a Prometheus exporter using monitord to export statistic to Prometheus collectors...

[SECURITY] Fedora 42 Update: node-exporter-1.10.2-3.fc42

Prometheus exporter for hardware and OS metrics exposed by NIX kernels, writ ten in Go with pluggable metric collectors...

[SECURITY] Fedora 43 Update: node-exporter-1.10.2-3.fc43

Prometheus exporter for hardware and OS metrics exposed by NIX kernels, writ ten in Go with pluggable metric collectors...

AZL-77073 CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...