1846 matches found
CVE-2026-16100
CVE-2026-16100 describes a flaw in Keycloak where, when metrics are enabled, raw error messages from failed account operations are recorded as Prometheus metric labels. Because these messages may include user-supplied input (e.g., nonexistent client IDs), an authenticated user can generate an eno...
CVE-2026-16100
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.2-0.2.hum1 aarch64, x8664 prometheus3.13-3.13.2-0.2.hum1.src src Security Fixes: prometheus3.13: CVE-2026-69153...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.5: prometheus3.5-3.5.5-0.7.hum1 aarch64, x8664 prometheus3.5-3.5.5-0.7.hum1.src src Security Fixes: prometheus3.5: CVE-2026-69153...
golang-github-prometheus-prometheus-3.13.2-1.1 on GA media (moderate)
golang-github-prometheus-prometheus-3.13.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11436-1 Rating: moderate Cross-References: CVE-2023-45289 CVE-2025-4673 CVE-2026-44990 CVE-2026-56852 CVSS scores: CVE-2023-45289 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2025-4673 SUSE...
OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media
These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
EUVD-2026-51861
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342 ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...
CVE-2026-67342
ArcadeDB is affected in versions before 26.7.2 where an authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints, failing to validate database access permissions. Attackers can call affected endpoints with arbitrary database parameters to access and m...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.2-0.1.hum1 aarch64, x8664 prometheus3.13-3.13.2-0.1.hum1.src src Security Fixes: prometheus3.13: CVE-2026-56852...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.5: prometheus3.5-3.5.5-0.6.hum1 aarch64, x8664 prometheus3.5-3.5.5-0.6.hum1.src src Security Fixes: prometheus3.5: CVE-2026-53669...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.1-0.5.hum1 aarch64, x8664 prometheus3.13-3.13.1-0.5.hum1.src src Security Fixes: prometheus3.13: CVE-2026-53669...
CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
Security update for prometheus-ha_cluster_exporter
This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2 Use proper obs time forma...
SUSE-SU-2026:3421-1 Security update for prometheus-ha_cluster_exporter
This update for prometheus-haclusterexporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: - Release 1.4.2 Use proper obs time...