GO-2026-6609 vulnerabilities

Vulnerabilities for packages: grafana, prometheus-adapter, ingress-nginx-controller, argo-cd, opencost, terragrunt, falco-no-driver, kyverno-policy-reporter, hubble-ui, filebrowser, flux-source-controller, cert-manager, loki, rclone, kyverno-policy-reporter-ui, argo-workflows,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: grafana, prometheus-adapter, ingress-nginx-controller, argo-cd, opencost, terragrunt, falco-no-driver, kyverno-policy-reporter, hubble-ui, filebrowser, flux-source-controller, cert-manager, loki, rclone, kyverno-policy-reporter-ui, argo-workflows,...

CLEANSTART-2026-GU78315 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the grafana-alloy package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-MX93537 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the grafana-alloy package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: datadog-agent, grafana, kots, zot, grafana-mimir, falcosidekick, loki, distribution, amazon-cloudwatch-agent, harbor-registry, tempo, opentofu, pulumi-kubernetes-operator, fluent-bit-plugin-loki, caddy, aws-otel-collector, grafana-pyroscope, mcp-grafana, grafana-allo...

CLEANSTART-2026-WM90638 Security fix for ghsa-259r-337f-4rfw applied in: grafana-alloy 1.16.3-r0

Security vulnerability affects the grafana-alloy package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CI21288 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

CLEANSTART-2026-TI06135 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the grafana-alloy package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-WI37742 Security fix for ghsa-hrxh-6v49-42gf applied in: grafana-alloy 1.16.3-r1

Security vulnerability affects the grafana-alloy package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-LK90655 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

CLEANSTART-2026-LY29111 DataRow

Security vulnerability affects the grafana-alloy package. The DataRow...

CLEANSTART-2026-JB79169 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the grafana-alloy package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-MY24201 pgx is a PostgreSQL driver and toolkit for Go

Security vulnerability affects the grafana-alloy package. pgx is a PostgreSQL driver and toolkit for Go...

CLEANSTART-2026-XW68310 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages

Security vulnerability affects the grafana-alloy package. OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages...

CLEANSTART-2026-PO98584 Security fix for ghsa-jqcq-xjh3-6g23 applied in: grafana-alloy-fips 1.12.1-r2

Security vulnerability affects the grafana-alloy-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OU05984 Security fix for ghsa-x6gf-mpr2-68h6 applied in: grafana-alloy-fips 1.12.1-r2

Security vulnerability affects the grafana-alloy-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LL04438 Security fix for CVE-2026-33762 applied in: argo-cd 3.2.7-r2, argo-cd 3.3.5-r2, argo-cd-fips 3.1.14-r0, argo-cd-fips 3.2.9-r0, external-secrets-fips 0.17.0-r2, flux-image-automation-controller-fips 4.0.1-r0, gitlab-runner 18.11.1-r0, gptscript 0.9.8-r0, grafana-alloy 1.13.1-r1, grafana-alloy 1.14.0-r1, grafana-alloy 1.14.1-r1, grafana-alloy 1.14.2-r0, grafana-alloy 1.15.0-r0, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.16.0-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 2.7.0-r0, syft 1.42.4-r0, timoni 0.25.2-r0

CVE-2026-33762 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GW50856 Security fix for CVE-2026-33997 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300069.0-r1, gitlab-runner 18.11.1-r0, grafana-alloy 1.14.2-r2, grafana-alloy 1.15.0-r0, grafana-alloy 1.15.1-r1, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.15.1-r0, k8ssandra-client-fips 0.6.4-r7, k8ssandra-client-fips 0.7.0-r5, melange 0.55.0-r1, melange 0.56.1-r1, paranoia 0.2.1-r0, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, promxy 0.0.93-r1, pulumi 3.299.0-r0, rancher-agent 2.11.15-r1, spire-server-fips 1.15.1-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-33997 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...