Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

GHSA-VFFH-X6R8-XX99 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

[SECURITY] Fedora 42 Update: mupdf-1.26.3-6.fc42

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kserve-rest-proxy, rancher-agent, kubernetes-replicator, cilium, custom-pod-autoscaler-operator, net-kourier, zot, azure-workload-identity-webhook, frp, kuberlr, yunikorn-k8shim, pgtimetable, grafana-agent-operator, syft, kube-vip, postgres-operator, db-operator,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kserve-rest-proxy, rancher-agent, kubernetes-replicator, cilium, custom-pod-autoscaler-operator, net-kourier, zot, azure-workload-identity-webhook, frp, kuberlr, yunikorn-k8shim, pgtimetable, grafana-agent-operator, syft, kube-vip, postgres-operator, db-operator,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, hcl2json-fips, go-spdk-helper-fips, pvc-autoresizer, velero-plugin-for-csi-fips, chronyexporter, vertical-pod-autoscaler, xeol, percona-server-mongodb-operator, licenseclassifier, vault-csi-provider, pushprox, neuvector-dbgen-fips, sbom-conver...

CLEANSTART-2026-NG75665 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the kube-state-metrics package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-BM53321 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the kube-state-metrics package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-QN98167 html

Multiple security vulnerabilities affect the kube-state-metrics package. The html. See references for individual vulnerability details...

CLEANSTART-2026-WY13161 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the kube-state-metrics package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

ChatGPT, Is This Real? the Influence of Generative AI on Writing Style in Top-Tier Cybersecurity Papers

With the release of ChatGPT in 2022, generative AI has significantly lowered the cost of polishing and rewriting text. Due to its widespread usage, conference organizers instated specific requirements researchers need to adhere to when using GenAI. When asked to rewrite text, GenAI can introduce...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: lazydocker, datadog-operator, gogatekeeper, opentelemetry-operator, azcopy, kubo, cilium, amazon-cloudwatch-agent, argo-events, cluster-api-ipam-provider-in-cluster, crossplane-provider-aws-s3, net-kourier, rancher-agent, cadvisor, pulumi-kubernetes-operator, zot,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: lazydocker, datadog-operator, gogatekeeper, opentelemetry-operator, azcopy, kubo, cilium, amazon-cloudwatch-agent, argo-events, cluster-api-ipam-provider-in-cluster, crossplane-provider-aws-s3, net-kourier, rancher-agent, cadvisor, pulumi-kubernetes-operator, zot,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose-fips, ferretdb, steampipe, crossplane-provider-aws-sns, grype-fips, gitlab-rails-ce, crossplane-provider-azure-storagecache, crossplane-provider-aws-dynamodb-fips, zarf, crossplane-provider-aws-imagebuilder, rancher,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose-fips, ferretdb, steampipe, crossplane-provider-aws-sns, grype-fips, gitlab-rails-ce, crossplane-provider-azure-storagecache, crossplane-provider-aws-dynamodb-fips, zarf, crossplane-provider-aws-imagebuilder, rancher,...

GHSA-3CJC-VHFM-FFP2 Apache DolphinScheduler vulnerable to sensitive information disclosure

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.. Users are...

RLSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

Cybersecurity Metrics Every CISO Should Report to the Board

Cybersecurity Metrics Every CISO Should Report to the Board After twenty years of leading security teams and presenting to boards at companies like Tripwire and RiskIQ, I can tell you this: the metrics that matter to your SOC team are not the metrics that matter in the boardroom. Boards do not wa...

Risk-Based Vulnerability Management: The Complete Guide to Smarter Threat Prioritization

Your vulnerability scanner just flagged 12,000 findings. Your team has the bandwidth to remediate maybe 200 this sprint. Which ones do you fix first? If your answer is "sort by CVSS score and work down the list," you are making the same mistake most security teams make. You are treating a 9.8-rat...

UBUNTU-CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...