56 matches found
CVE-2025-41118
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
CVE-2025-41118
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
CVE-2025-41118
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
CVE-2025-41118: Incorrect Permission Assignment for Critical Resource
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
Pyroscope security vulnerabilities
Pyroscope is an open-source continuous performance analysis platform developed by Grafana. Vulnerabilities exist in versions prior to Pyroscope 1.15.2, 1.16.1, and 1.17.0. These vulnerabilities stem from improper configuration, potentially allowing attackers to extract the secretkey configuration...
GHSA-78H2-9FRX-2JM8 vulnerabilities
Vulnerabilities for packages: tfsec, rancher-agent, elastic-agent, envconsul-fips, velero, frankenphp-8.3, packer, boring-registry, prometheus-podman-exporter, gitlab-kas-fips, skaffold, tflint, cerbos, trufflehog, task, k9s, percona-server-mongodb-operator-fips, tkn-fips, sqlexporter, packer-fip...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: kube-state-metrics, rancher, gitaly, kaf, step, net-kourier, step-issuer, rancher-helm, terraform-provider-time, lvm-driver, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, kubo, polaris, mariadb-operator, octo-sts, prometheus-adapter, terragrun...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: git-sync, http-echo, actions-runner-controller, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, redpanda, step-kms-plugin, redis-operator, contour, falcoctl, sftpgo-plugin-eventstore, kubernetes-dashboard-api, thanos-operator, azcopy,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: git-sync, http-echo, actions-runner-controller, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, redpanda, step-kms-plugin, redis-operator, contour, falcoctl, sftpgo-plugin-eventstore, kubernetes-dashboard-api, thanos-operator, azcopy,...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: git-sync, http-echo, actions-runner-controller, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, redpanda, step-kms-plugin, redis-operator, contour, falcoctl, sftpgo-plugin-eventstore, kubernetes-dashboard-api, thanos-operator, azcopy,...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: kube-state-metrics, rancher, gitaly, kaf, step, net-kourier, step-issuer, rancher-helm, terraform-provider-time, lvm-driver, conftest, flux-helm-controller, kubernetes-csi-node-driver-registrar, kubo, polaris, mariadb-operator, octo-sts, prometheus-adapter, terragrun...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter, tfsec, cortex-fips, kubernetes-csi-livenessprobe, crossplane-provider-aws-ecr, redpanda, rancher-agent, cloudnative-pg-fips, elastic-agent, envconsul-fips, kubernetes-csi-external-provisioner-fips, terraform-provider-databricks,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter, tfsec, cortex-fips, kubernetes-csi-livenessprobe, crossplane-provider-aws-ecr, redpanda, rancher-agent, cloudnative-pg-fips, elastic-agent, envconsul-fips, kubernetes-csi-external-provisioner-fips, prometheus-beat-exporter,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter, tfsec, cortex-fips, kubernetes-csi-livenessprobe, crossplane-provider-aws-ecr, redpanda, rancher-agent, cloudnative-pg-fips, elastic-agent, envconsul-fips, kubernetes-csi-external-provisioner-fips, prometheus-beat-exporter,...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter, tfsec, cortex-fips, kubernetes-csi-livenessprobe, blobfuse2-fips, crossplane-provider-aws-ecr, redpanda, rancher-agent, cloudnative-pg-fips, elastic-agent, envconsul-fips, kubernetes-csi-external-provisioner-fips,...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: tfsec, cortex-fips, elastic-agent, kubernetes-csi-external-provisioner-fips, velero, packer, prometheus, boring-registry, aws-ebs-csi-driver, docker-compose, skaffold, tflint, cerbos, cass-operator-fips, cluster-api-gcp-controller-fips, task, k9s, kapp-controller,...
Grafana Pyroscope Continuous Profiling Information Disclosure
The vulnerability of Grafana Pyroscope’s continuous profiling software is related to the exposure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...
Exposure of Storage Secret in Pyroscope
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...