GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, flux, containerd, traefik-fips, gitsign, prometheus-mongodb-exporter, apply-cve-bump, istio, guac, traefik, commercial-grafana, argocd-image-updater, gitlab-rails-ce-fips, kyverno-fips, omnictl-multiarch-fips, k3s, kubernetes,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, crossplane-provider-azure-sql, knative-kafka-broker-fips, terraform-provider-azurerm-fips, frankenphp-8.3, flux, helmfile, kyverno-policy-reporter-plugins-kyverno, nfpm, neuvector-sigstore-interface-fips, terraform,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, crossplane-provider-azure-sql, knative-kafka-broker-fips, terraform-provider-azurerm-fips, frankenphp-8.3, flux, helmfile, kyverno-policy-reporter-plugins-kyverno, nfpm, neuvector-sigstore-interface-fips, terraform,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: nfpm, terraform, crossplane-provider-aws-cloudfront, rootlesskit-fips, guac, crossplane-provider-aws-bedrockagent-fips, clickhouse-backup-fips, k3s, databricks-cli-fips, rancher-machine, crossplane-provider-azure-servicefabric, atlantis,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: nfpm, terraform, crossplane-provider-aws-cloudfront, rootlesskit-fips, guac, crossplane-provider-aws-bedrockagent-fips, clickhouse-backup-fips, k3s, databricks-cli-fips, rancher-machine, crossplane-provider-azure-servicefabric, atlantis,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips, cloud-provider-aws, teleport-operator-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, nfpm, terraform, wal-g, prometheus-mongodb-exporter, rootlesskit-fips, guac, frankenphp-8.2, longhorn-cli, trivy-fips, flux-source-controller, clickhouse-backup-fips, kyverno-fips, k3s, rancher-machine,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, nfpm, terraform, prometheus-mongodb-exporter, guac, frankenphp-8.2, trivy-fips, flux-source-controller, kyverno-fips, k3s, external-secrets-operator, terragrunt, tekton-pipelines, mapotf, etcd-fips, spire-server,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, frankenphp-8.3, flux, terraform, prometheus-mongodb-exporter, frankenphp-8.2, kyverno-fips, k3s, external-secrets-operator, tekton-pipelines, etcd-fips, spire-server, tekton-pipelines-fips, cloud-provider-aws, teleport-operator-fips,...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: istio, containerd, prometheus, external-secrets-operator, gitsign, k3s, telegraf, terragrunt, guac, mattermost, argocd-image-updater, argo-events...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: containerd, cilium-cli, external-secrets-operator, osv-scanner, prometheus-operator, k3s, kyverno, spire-server, flux, gitlab-kas, gitea, opentelemetry-collector, skaffold, helm, flux-source-controller, kubernetes, cloud-provider-aws, cilium, chisel, minio, snyk-cli,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: containerd, cilium-cli, external-secrets-operator, osv-scanner, prometheus-operator, k3s, kyverno, spire-server, flux, gitlab-kas, gitea, opentelemetry-collector, skaffold, helm, flux-source-controller, kubernetes, cloud-provider-aws, cilium, chisel,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: containerd, cilium-cli, external-secrets-operator, osv-scanner, prometheus-operator, chezmoi, k3s, melange, kyverno, podman, pulumi-language-yaml, argo-cd, spire-server, splunk-otel-collector, flux, gitlab-kas, gitea, opentelemetry-collector, skaffold, argo-events,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: containerd, docker-cli-buildx, cilium-cli, external-secrets-operator, prometheus-operator, buildah, k3s, kyverno, podman, spire-server, flux, gitlab-kas, opentelemetry-collector, helm, kubernetes, cloud-provider-aws, cilium, minio, snyk-cli, fscrypt, istio, prometheu...

SUSE CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...

GO-2026-5662 Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus...

GO-2026-5381 Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus...