CVE-2026-97030 vulnerabilities

Vulnerabilities for packages: falcoctl, opentofu, cluster-api-gcp-controller, cloud-sql-proxy, etcd, osv-scanner, grafana-pyroscope, azure-service-operator, crossplane-provider-aws-sns, grafana-mimir, spicedb-operator, chartmuseum, filebrowser, crossplane-provider-aws-iam, authservice,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, rancher, opencost, argo-workflows, continuity, loki, grafana-pyroscope, kubernetes, falco-no-driver, zarf, chartmuseum, filebrowser, openbao, juicefs, mesosphere-vsphere-csi, argo-cd, ingress-nginx-controller, grafana, yunikorn-web, step, k6,...

GHSA-F5VF-8PVC-394G vulnerabilities

Vulnerabilities for packages: falcoctl, opentofu, cluster-api-gcp-controller, timestamp-authority, cluster-api, cloud-sql-proxy, aws-application-networking-k8s, continuity, etcd, istio, osv-scanner, grafana-pyroscope, azure-service-operator, crossplane-provider-aws-sns, grafana-mimir,...

CLEANSTART-2026-XX38333 Prometheus is an open-source monitoring system and time series database

CVE-2026-42154 affects multiple packages. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-TZ27062 Prometheus is an open-source monitoring system and time series database

CVE-2026-44903 affects multiple packages. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-FB95411 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the cortex package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-KL35365 Prometheus is an open-source monitoring system and time series database

CVE-2026-42151 affects multiple packages. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

GHSA-6R69-C6WG-7G8M yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840

The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...

EUVD-2026-95935

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11

CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11. A patched version of the package is available...

SUSE-SU-2026:4606-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infini...

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite...

CLEANSTART-2026-GD06163 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the node-problem-detector package. Prometheus is an open-source monitoring system and time series database...