AZL-88239 CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88245 CVE-2026-25681 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88230 CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5

CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5. A patched version of the package is available...

CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.12.0-5

CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.12.0-5. A patched version of the package is available...

CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.10.0-19

CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.10.0-19. A patched version of the package is available...

AZL-77073 CVE-2025-58190 affecting package prometheus-adapter for versions less than 0.12.0-5

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76983 CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.10.0-19

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-77070 CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.12.0-5

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: grafana, temporal, mesosphere-vsphere-csi, sftpgo-plugin-pubsub, kube-bench, policy-controller, promxy, steampipe, php-fpmexporter, spicedb-operator, ko, gitness, kubernetes-dashboard-auth, task, terraform-provider-google, falco-no-driver, terraform-mcp-server,...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: grafana, temporal, mesosphere-vsphere-csi, sftpgo-plugin-pubsub, kube-bench, policy-controller, promxy, steampipe, php-fpmexporter, spicedb-operator, ko, gitness, kubernetes-dashboard-auth, task, terraform-provider-google, falco-no-driver, terraform-mcp-server,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

CVE-2025-58183 vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, regclient, prometheus-mysqld-exporter-fips, dapr-fips, git-credential-oauth, k8ssandra-client-fips, kube-bench, crane, apm-server-fips, dockerize, scorecard, wait-for-port, prometheus, etcd-fips,...

CVE-2025-22872 affecting package prometheus-adapter for versions less than 0.12.0-3

CVE-2025-22872 affecting package prometheus-adapter for versions less than 0.12.0-3. A patched version of the package is available...

AZL-60550 CVE-2025-22872 affecting package prometheus-adapter for versions less than 0.12.0-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: kaf, neuvector-dbgen, octo-sts, dataplaneapi-fips, bazelisk, crossplane-provider-aws-lambda, prometheus-beat-exporter, regclient, seaweedfs, k8ssandra-client-fips, kube-bench, crane, aws-flb-cloudwatch, ollama, dockerize, crossplane-provider-aws-s3, grafana-alloy,...