GO-2026-6505 vulnerabilities

Vulnerabilities for packages: tempo, slsa-verifier, skaffold, spark-operator, cloudflared, flux-source-controller, gitness, aws-otel-collector, helm-operator, bento, opencost, kapp-controller, opentofu, ko, rancher-agent, k9s, witness, newrelic-infrastructure-agent, crossplane, kots,...

CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10. A patched version of the package is available...

AZL-101079 CVE-2026-84445 affecting package prometheus-adapter 0.12.0-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-100944 CVE-2026-83530 affecting package prometheus-adapter 0.12.0-10

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-99333 CVE-2026-84304 affecting package prometheus-adapter 0.12.0-9

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9. A patched version of the package is available...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, rancher-webhook, rancher-webhook-fips, caddy, buildkitd, kubernetes-fips, up, kubevela, k3s, metrics-server-fips, kube-oidc-proxy, kubernetes...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubernetes-dns-node-cache, spark-operator, ip-masq-agent, nodetaint, aws-efs-csi-driver-fips, prometheus-adapter, aws-ebs-csi-driver...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, metrics-server, kubernetes-dashboard-metrics-scraper, docker-credential-ecr-login, cni-plugins-fips, gops, ip-masq-agent, prometheus-stackdriver-exporter, sonobuoy, gosu, grpcurl, kubernetes-csi-livenessprobe, oras, cass-operator-fips, k3d, nats,...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: kubevela, buildkitd, caddy, up, k3s, kubernetes, prometheus-adapter...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, spark-operator, ip-masq-agent, prometheus-adapter, kubernetes-dns-node-cache, aws-efs-csi-driver...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, slsa-verifier, spark-operator, nova, terraform-provider-acme, trino, envconsul, docker-credential-acr-env, golangci-lint, tofu-controller, bento, crossplane-provider-azure-storage, nri-consul, cis-operator, newrelic-nri-statsd,...

CLEANSTART-2026-MN93701 Security fixes in prometheus-adapter 0.12.0-r1

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

PT-2026-85963

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

AZL-95946 CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7. A patched version of the package is available...

AZL-93279 CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: nova, gitness, trino, aws-otel-collector, envconsul, newrelic-nri-statsd, wolfictl, cfssl, nri-f5, openbao-k8s, opentofu, rqlite, crossplane-provider-aws-cloudwatchlogs, aws-flb-firehose, newrelic-infrastructure-agent, tkn, kubernetes-csi-external-attacher,...

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...