CLEANSTART-2026-YV85299 Security fix for GHSA-8wmf-6v46-5gfg applied in: prometheus-operator 0.92.1-r6, argo-cd 3.4.10-r3

GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-33374

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

UBUNTU-CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions...

EUVD-2026-98905

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions...

CVE-2026-33374

The Prometheus rule conversion API endpoints in Grafana are vulnerable to an unbounded memory allocation issue. Because the application does not limit the request body size , authenticated users can trigger excessive memory consumption, potentially causing a server crash due to out-of-memory (OOM...

CVE-2026-33374 Unbounded memory allocation in the Prometheus rule conversion API

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions...

PT-2026-111740

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Authenticated users can cause the server to crash due to out-of-memory conditions. This occurs because the Prometheus rule conversion API endpoints do not limit the request body size, enablin...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.5.0 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

CVE-2026-108736

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736

Speedtest Tracker versions through 1.15.0 are vulnerable to an IP allowlist bypass due to improper handling of the X-Forwarded-For header. The application's bootstrap/app.php file incorrectly trusts every peer as a proxy, allowing unauthenticated remote attackers to spoof headers to evade ALLOWED...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

EUVD-2026-96902

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

PT-2026-110139

Name of the Vulnerable Software and Affected Versions Speedtest Tracker versions prior to 1.15.1 Description An IP allowlist bypass allows unauthenticated remote attackers to evade ALLOWED IPS and Prometheus allowlists. This occurs because the bootstrap/app.php file trusts every peer as a proxy,...

CVE-2026-108736: Use of Less Trusted Source

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

GO-2026-6599 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation-fips, crossplane-provider-family-gcp-config-fips, grype-fips, percona-telemetry-agent, tkn-fips, lvm-driver, vault-secrets-operator-fips, crossplane-provider-aws-elasticsearch-fips, prometheus-postgres-exporter-fips,...

CVE-2026-94448 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation-fips, crossplane-provider-family-gcp-config-fips, grype-fips, percona-telemetry-agent, tkn-fips, lvm-driver, vault-secrets-operator-fips, crossplane-provider-aws-elasticsearch-fips, prometheus-postgres-exporter-fips,...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: zitadel, k8s-device-plugin, loki, reports-server, tempo-fips, prometheus, kyverno, ingress-nginx-controller, containerd, omnictl-multiarch-fips, karpenter-fips, commercial-gitlab-rails-ee-fips, karpenter, consul-k8s, qemu-guesthelper, commercial-gitlab-rails-ee,...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: cert-manager, grafana-pyroscope, gitness, rancher-agent, gitlab-pages, chartmuseum, filebrowser, k8s-device-plugin, rclone, mesosphere-vsphere-csi, openbao, kubernetes, hubble-ui, grafana, falco-no-driver, flux-source-controller, argo-workflows, juicefs,...