prometheus-kafka-consumer-group-exporter (0.3.1) potentially affected by CVE-2026-10143 via kafka-python (1.3.5)

kafka-python PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - prometheus-kafka-consumer-group-exporter 0.3.1 Source cves: CVE-2026-10143 Source advisory: OSV:GHSA-2JCM-HQ8R-84WX...

prometheus-kafka-consumer-group-exporter (0.3.1) potentially affected by CVE-2026-10142 via kafka-python (1.3.5)

kafka-python PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - prometheus-kafka-consumer-group-exporter 0.3.1 Source cves: CVE-2026-10142 Source advisory: OSV:GHSA-M3PX-Q5GJ-J9X7...

OPENSUSE-SU-2026:10997-1 golang-github-prometheus-prometheus-3.12.0-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.12.0-2.1 package on the GA media of openSUSE Tumbleweed...

prometheus-kafka-consumer-group-exporter (0.3.1) potentially affected by CVE-2026-10142 via kafka-python (1.3.5)

kafka-python PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - prometheus-kafka-consumer-group-exporter 0.3.1 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

prometheus-kafka-consumer-group-exporter (0.3.1) potentially affected by CVE-2026-10143 via kafka-python (1.3.5)

kafka-python PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - prometheus-kafka-consumer-group-exporter 0.3.1 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint /api/v1/read by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service DoS...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

CLEANSTART-2026-ZH27719 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-WO73902 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Multiple security vulnerabilities affect the prometheus package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-DF67461 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the prometheus package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-HN49173 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-JN91167 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-EX51963 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

PT-2026-56742

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

PT-2026-48539

Name of the Vulnerable Software and Affected Versions opentelemetry-operator affected versions not specified Description The TargetAllocator in the OpenTelemetry Operator processes ServiceMonitor resources and converts endpoints into Prometheus scrape configurations. A tenant with permissions to...

io.micrometer:micrometer-atlas-starter (0.8.0.release), io.micrometer:micrometer-datadog-starter (0.8.0.release) +5 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.8.0.release)

io.micrometer:micrometer-core MAVEN version 0.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.8.0.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.6.3.release), io.micrometer:micrometer-datadog-starter (0.6.3.release) +2 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.6.3.release)

io.micrometer:micrometer-core MAVEN version 0.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.6.3.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.7.0.release), io.micrometer:micrometer-datadog-starter (0.7.0.release) +2 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.7.0.release)

io.micrometer:micrometer-core MAVEN version 0.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.7.0.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.9.0.release), io.micrometer:micrometer-datadog-starter (0.9.0.release) +6 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.9.0.release)

io.micrometer:micrometer-core MAVEN version 0.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.9.0.release - io.micrometer:micrometer-datadog-start...