CLEANSTART-2026-WI70970 Security fixes in prometheus-fips 3.9.0-r0

Package prometheus-fips version 3.9.0-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: gomplate, opentelemetry-collector, flux-notification-controller-fips, flux-fips, keda-fips, crossplane-provider-azure-servicebus, crossplane-provider-azure-signalrservice, eksctl, mods, trivy-operator-fips, sops-fips, google-guest-agent-manager, tekton-chains,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, flux-fips, keda-fips, trivy-operator-fips, gitea-fips, gatekeeper, osv-scanner, zitadel, coder-fips, chisel-fips, opentofu, prometheus-operator, knative-eventing-fips, flux-image-automation-controller, kubernetes, argo-workflows, drone,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: gomplate, opentelemetry-collector, flux-fips, keda-fips, trivy-operator-fips, docker, gitea-fips, gatekeeper, osv-scanner, rootlesskit-fips, zitadel, coder-fips, grype-fips, chisel-fips, opentofu, prometheus-operator, prometheus-podman-exporter-fips,...

CLEANSTART-2026-XZ04425 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the prometheus-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-LS08172 Within HostnameError

Multiple security vulnerabilities affect the prometheus-fips package. Within HostnameError. See references for individual vulnerability details...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: trivy, cri-tools, kargo, kpt, loki, flux-image-reflector-controller, eksctl, rancher-machine, skopeo, k3s, zot, tekton-chains, cosign, kubevela, argo-workflows-fips, nerdctl, zarf, skaffold, slsa-verifier, docker-credential-gcr, flux, pulumi, dagger, crane,...

CVE-2023-45286 vulnerabilities

Vulnerabilities for packages: rclone...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: slsa-verifier, chartmuseum, skaffold, up, paranoia, kpt, kubescape, spire-server-fips, k3s, k3d, falcoctl-fips, tekton-chains, rancher-agent, scorecard, bom, aactl, ctop...