50 matches found
EUVD-2026-63474
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root...
CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
PT-2026-79061
Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...
CVE-2026-19898
CVE-2026-19898 affects VictoriaMetrics up to version 1.146.0, specifically the VMAuth Authentication Endpoint (file app/vmauth/main.go, function requestHandler). A manipulation can lead to improper restriction of excessive authentication attempts, with remote attack possibility. The exploit is de...
EUVD-2026-59772
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
GO-2025-4161 vulnerabilities
Vulnerabilities for packages: victoriametrics-operator-fips, victorialogs-fips, victorialogs...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: temporal-fips, dkron, go, flux-operator-fips, pluto, flux-operator, librechat, victoriametrics, metacontroller, omnictl-multiarch, flux-image-automation-controller, flux-notification-controller, flux-source-watcher, aws-load-balancer-controller-fips,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: metacontroller, victoriametrics, go, dkron, flux-source-controller, pluto, steampipe, flux-helm-controller, victoriametrics-cluster, grafana-operator, flux-image-automation-controller, polaris, grafana-rollout-operator, podinfo, terragrunt,...
GO-2026-4599 vulnerabilities
Vulnerabilities for packages: metacontroller, victoriametrics, go, dkron, flux-source-controller, pluto, steampipe, flux-helm-controller, victoriametrics-cluster, grafana-operator, flux-image-automation-controller, polaris, grafana-rollout-operator, podinfo, terragrunt,...
GO-2026-4866 vulnerabilities
Vulnerabilities for packages: metacontroller, spire-server, victoriametrics, newrelic-infra-operator, go, kubewatch, aws-load-balancer-controller, goreleaser, nfs-subdir-external-provisioner, oras, dgraph, dataplaneapi, dkron, supercronic, ingress-nginx-controller, sftpgo-plugin-eventsearch,...
CLEANSTART-2026-CZ42284 Security fixes in victoriametrics-operator 0.72.0-r1
Package victoriametrics-operator version 0.72.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-ER59632 Security fixes in victoriametrics-operator 0.71.0-r1
Package victoriametrics-operator version 0.71.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-HS77703 Security fixes in victoriametrics-operator 0.72.0-r2
Package victoriametrics-operator version 0.72.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-FV97418 Security fixes in victoriametrics-operator 0.71.0-r2
Package victoriametrics-operator version 0.71.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-IH71492 Security fixes in victoriametrics-operator-fips 0.65.0-r0
Package victoriametrics-operator-fips version 0.65.0-r0 fixes 1 vulnerabilities: ghsa-66jq-2c23-2xh5...
CLEANSTART-2026-KF37160 Security fixes in victoriametrics-cluster 1.132.0-r1
Package victoriametrics-cluster version 1.132.0-r1 fixes 1 vulnerabilities: CVE-2025-68121...