GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kuberay-operator, crossplane-provider-aws-cloudfront, kbld, opentofu, conftest, flyte, containerd, kuma, kubernetes-csi-external-provisioner, podinfo, aws-flb-kinesis, gomplate, kube-logging-operator, mattermost, net-kourier, cri-tools, speedtest-go, wuzz,...

CLEANSTART-2026-MN93701 Security fixes in prometheus-adapter 0.12.0-r1

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

PT-2026-85963

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

AZL-95946 CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7. A patched version of the package is available...

AZL-93279 CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: kapp, kuberay-operator, kbld, podinfo, weaviate, kube-logging-operator, mattermost, kubeflow-pipelines, crossplane-provider-aws-eks, falcosidekick, aws-load-balancer-controller, frp, witness, crossplane-provider-aws-kinesis, gatus, nri-discovery-kubernetes, otel-cli,...

CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-39821 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-39821 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-25681 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-25681 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

AZL-88236 CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88239 CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88233 CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88227 CVE-2026-39821 affecting package prometheus-adapter for versions less than 0.12.0-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-88245 CVE-2026-25681 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88230 CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5

CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5. A patched version of the package is available...