CLEANSTART-2026-OS08278 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-cgrx-mc8f-2prm, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-vvgc-356p-c3xw applied in versions: 1.10.2-r0, 1.10.2-r1, 1.5.0-r0, 1.9.1-r0

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-41785

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 Description OpenTelemetry eBPF Instrumentation OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, loki, tempo, fluent-bit-plugin-loki, minio-object-browser, keda, minio, node-problem-detector, cloud-sql-proxy, istio, opentelemetry-collector-contrib, datadog-agent, telegraf, metrics-server, opentelemetry-operator, minio-operator, k8sgpt,...

0perator (>=0.1.0 <=0.3.0), 0pflow (>=0.1.0 <=0.1.0-dev.f5622ac) +1793 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.10.2 <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.10.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4, =0.1.0, =0.4.0, =5.0.1-staging.f17326334 and more Source cves: CVE-2026-44902 Source...

Improper Handling of Exceptional Conditions

Overview @opentelemetry/exporter-prometheus is an OpenTelemetry Exporter Prometheus provides a metrics endpoint for Prometheus Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the PrometheusExporter process. An attacker can cause the process to...

0perator (>=0.1.0 <=0.3.0), 0pflow (>=0.1.0 <=0.1.0-dev.f5622ac) +1793 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.10.2 <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.10.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4, =0.1.0, =0.4.0, =5.0.1-staging.f17326334 and more Source cves: CVE-2026-44902 Source...

GHSA-Q7RR-3CGH-J5R3 Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

Prometheus exporter process crash via malformed HTTP request

Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...

PT-2026-39676

Name of the Vulnerable Software and Affected Versions opentelemetry-js versions prior to 0.217.0 Description A single malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default '0.0.0.0:9464' lacks error handling during URL...

GHSA-2283-WF8C-RW8R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips, aws-efs-csi-driver-fips, consul-fips,...

GHSA-3V2C-X6Q9-F697 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips, aws-efs-csi-driver-fips, consul-fips,...

CVE-2026-39826 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips, aws-efs-csi-driver-fips, consul-fips,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips, aws-efs-csi-driver-fips, consul-fips,...

CVE-2026-42501 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, nats-server-config-reloader-fips, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, nats-server-config-reloader, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker,...

CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips,...

CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, nats-server-config-reloader-fips, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, nats-server-config-reloader, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker,...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, nats-server-config-reloader-fips, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, nats-server-config-reloader, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker,...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker, crossplane-provider-aws-directconnect, nrdot-collector-k8s-fips,...

GHSA-QF3Q-3H68-MMH2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, nats-server-config-reloader-fips, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, nats-server-config-reloader, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-networkmanager, grafana-mimir, nats-server-config-reloader-fips, crossplane-provider-aws-mediapackage, oauth2-proxy-fips, nats-server-config-reloader, timestamp-authority-fips, kyverno-notation-aws-fips, knative-kafka-broker,...