CLEANSTART-2026-ZC33521 Security fix for CVE-2025-22873 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-22873 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IS77725 Security fix for CVE-2023-40577 applied in: prometheus 2.47.2-r0, prometheus-alertmanager 0.26.0-r0, promxy 0.0.93-r1, promxy-fips 0.0.93-r1

CVE-2023-40577 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IX15108 Security fix for CVE-2024-6104 applied in: prometheus 2.47.2-r0, rekor-backfill-index 1.2.2-r0

CVE-2024-6104 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OT08451 Security fix for CVE-2026-40898 applied in: kube-metrics-adapter 0.2.9-r0, kubernetes-dns-node-cache 1.23.1-r0, kubernetes-dns-node-cache 1.24.1-r1, kubernetes-dns-node-cache 1.25.0-r8, kubernetes-dns-node-cache 1.26.0-r1, prometheus-blackbox-exporter 0.28.0-r2

CVE-2026-40898 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AC15686 Security fix for CVE-2026-41567 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, rancher-agent 2.11.15-r1

CVE-2026-41567 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FX37210 Security fix for CVE-2026-42306 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, rancher-agent 2.11.15-r1, vault 1.19.5-r1

CVE-2026-42306 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YU49777 Security fix for CVE-2026-28735 applied in: prometheus-node-exporter 1.10.2-r3, prometheus-node-exporter 1.11.1-r2, prometheus-node-exporter 1.12.1-r0, prometheus-node-exporter 1.9.1-r3

CVE-2026-28735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PM97219 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

PT-2026-101494

Security vulnerability affects the prometheus-blackbox-exporter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PX77651 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the prometheus-alertmanager package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

CLEANSTART-2026-GE74044 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. S...

CLEANSTART-2026-OE08543 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

AZL-101079 CVE-2026-84445 affecting package prometheus-adapter 0.12.0-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82426 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +4 more potentially affected by CVE-2026-82441 via org.apache.storm:storm-server (3.0.0)

org.apache.storm:storm-server MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-server and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging broker. In rabbitMQ-server prior to version 3.8.17, adding a new user through the management UI could result in the user’s banner being displayed in a confirmation message without proper tag sanitization, potentially allowing JavaScript code to execute withi...

Astra Linux – Vulnerability in golang-github-prometheus-client-golang

clientgolang is the instrumentation library for Go applications in Prometheus. The promhttp package within clientgolang provides tools for working with HTTP servers and clients. Prior to version 1.11.1 of clientgolang, HTTP servers were vulnerable to Denial of Service attacks due to unbounded...

CLEANSTART-2026-DB46993 Prometheus is an open-source monitoring system and time series database

Multiple security vulnerabilities affect the prometheus-operator package. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...