GO-2023-2020 vulnerabilities

Vulnerabilities for packages: promxy, prometheus-alertmanager...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, cortex, fulcio, rekor, grafana-mimir, timestamp-authority...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...

UBUNTU-CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CLEANSTART-2026-IU92725 Security fixes in prometheus-alertmanager 0.32.0-r0

Package prometheus-alertmanager version 0.32.0-r0 fixes 2 vulnerabilities: CVE-2026-39882, CVE-2026-39883...

CLEANSTART-2026-ZO84411 Security fixes in prometheus-alertmanager 0.26.0-r0

Package prometheus-alertmanager version 0.26.0-r0 fixes 1 vulnerabilities: CVE-2023-40577...

CLEANSTART-2026-ZP59365 Security fixes in prometheus-alertmanager 0.32.0-r1

Package prometheus-alertmanager version 0.32.0-r1 fixes 19 vulnerabilities: CVE-2026-39835, CVE-2026-46598, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502...

CVE-2026-67990: Cross-Site Request Forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

PT-2026-71596

Name of the Vulnerable Software and Affected Versions basecamp/upright versions prior to efe4f2e5254ac6e57e45d2261804cca74dbbca3f Description The software disables Rails Cross-Site Request Forgery CSRF protection—a mechanism that prevents unauthorized commands from being transmitted from a user...

CVE-2026-67990

The basecamp/upright library (specifically at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f ) contains a vulnerability where it disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers . This flaw allows an unauthenticated attacker to perform a Cross-Site Request For...

EUVD-2026-58031

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

BIT-GRAFANA-2026-21723 CVE-2026-21723 Record

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

Linux Distros Unpatched Vulnerability : CVE-2026-21723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

SUSE CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...