org.yamcs:distribution (>=5.0.0, <=5.12.7), org.yamcs:packet-viewer (>=5.0.0, <=5.12.7) +9 more potentially affected by CVE-2026-55548 via org.yamcs:yamcs-core (>=5.0.0, <=5.12.7)

org.yamcs:yamcs-core MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.1.0, =5.5.6, =0.1.0, =1.0.0, =0.1, =1.0.0, =5.0.0, =5.0.0, =0.1.0, =0.8.1 Source cves: CVE-2026-55548 Source advisory: GHSA-8XJQ-PR36-CCGF...

org.yamcs:distribution (>=5.0.0, <=5.12.7), org.yamcs:packet-viewer (>=5.0.0, <=5.12.7) +9 more potentially affected by CVE-2026-55547 via org.yamcs:yamcs-core (>=5.0.0, <=5.12.7)

org.yamcs:yamcs-core MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.1.0, =5.5.6, =0.1.0, =1.0.0, =0.1, =1.0.0, =5.0.0, =5.0.0, =0.1.0, =0.8.1 Source cves: CVE-2026-55547 Source advisory: SNYK:JAVA-ORGYAMCS-19428668...

org.yamcs:distribution (>=5.0.0, <=5.12.7), org.yamcs:packet-viewer (>=5.0.0, <=5.12.7) +9 more potentially affected by CVE-2026-55511 via org.yamcs:yamcs-core (>=5.0.0, <=5.12.7)

org.yamcs:yamcs-core MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.1.0, =5.5.6, =0.1.0, =1.0.0, =0.1, =1.0.0, =5.0.0, =5.0.0, =0.1.0, =0.8.1 Source cves: CVE-2026-55511 Source advisory: OSV:GHSA-3G44-3M7X-CGG2...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

EUVD-2026-66709

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

PT-2026-82280

Name of the Vulnerable Software and Affected Versions Static Web Server SWS versions prior to 2.44.0 Description Instances with both basic-auth and metrics features enabled process the '/metrics' endpoint before the basic-auth check in src/handler.rs. This allows an unauthenticated remote attacke...

SUSE SLES15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:3714-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3714-1 advisory. prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and...

BIT-KEYCLOAK-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: CVE-2026-39821: Fix validation bypass and...

SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass an...

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: golang-github-prometheus-alertmanager: CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 bsc1266615 golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4: Security fixes:...

SUSE-SU-2026:3713-1 Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 bsc1266615 golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4: - Security fixes: -...

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9. A patched version of the package is available...

EUVD-2026-63114

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...

CVE-2026-76262

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...

CVE-2026-76262 Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...