GO-2025-3833 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GO-2026-5501 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GO-2026-5030 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: mc, jaeger, tempo, minio-object-browser, telegraf, karma, datadog-agent, aws-otel-collector, splunk-otel-collector, trillian, istio, loki, cloud-sql-proxy, minio-operator, keda, grafana-pyroscope, prometheus-pushgateway, mcp-grafana, minio, certificate-transparency...

GO-2026-5327 vulnerabilities

Vulnerabilities for packages: ratify, promxy, slsa-verifier, argo-cd, amazon-cloudwatch-agent, vcluster, trufflehog, kubescape-operator, juicefs, teleport, ksops, kubescape, opentelemetry-collector-contrib, datadog-agent, grafana-mimir, hubble, migrate, consul-k8s, splunk-otel-collector, ferretdb...

GO-2026-5501 Pyroscope Exposes Storage Secret in github.com/grafana/pyroscope

Pyroscope Exposes Storage Secret in github.com/grafana/pyroscope...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, crossplane-provider-aws-cloudtrail, amazon-cloudwatch-agent-operator-fips, cerbos-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, ucd,...

CVE-2025-41118 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GHSA-M9HQ-H476-H2G8 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

CVE-2025-41118 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GHSA-M9HQ-H476-H2G8 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

BIT-GRAFANA-PYROSCOPE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118

A flaw was found in Pyroscope. When Tencent Cloud Object Storage COS is configured as the storage backend, an attacker with access to the Pyroscope API can extract the secretkey value in plaintext. This issue leads to sensitive information disclosure. Mitigation To mitigate this vulnerability,...

Pyroscope Exposes Storage Secret

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

EUVD-2025-209489

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

GHSA-M9HQ-H476-H2G8 Pyroscope Exposes Storage Secret

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the configuration API when type protection is missing for sensitive fields. An attacker can obtain confidential credentials by sending requests directly to the API...

CVE-2025-41118

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...