CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, memstress, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, memstress, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips,...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips, crossplane-provider-aws-datasyn...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, memstress, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips,...

GHSA-QF3Q-3H68-MMH2 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, memstress, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cinder-csi-plugin-fips, falco-no-driver, kyverno-policy-reporter-ui-fips, memstress, victorialogs-fips, zot, crossplane-provider-aws-appflow-fips, crossplane-provider-azure-powerbidedicated, kubernetes-dashboard-api-fips,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, dynamic-localpv-provisioner, cinder-csi-plugin-fips, kubernetes-dashboard-api-fips, crossplane-provider-aws-datasync, crossplane-provider-terraform, jaeger, prometheus-operator, flux-source-watcher-fips, metrics-agent-fips,...

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

...

Prometheus Azure AD remote write OAuth client secret exposed via config API

...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: loki, aws-otel-collector, mcp-grafana, minio-operator, trillian, prometheus, minio, certificate-transparency, opentelemetry-operator, mc, telegraf, tempo, opentelemetry-collector, opentelemetry-collector-contrib, jaeger, karma, datadog-agent, keda,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, datadog-agent, loki-fips, metrics-server-fips, mc, opentelemetry-collector-contrib-fips, cloudzero-agent-fips, ld-relay-fips, minio, nrdot-collector-k8s-fips, agentbeat, loki, opentelemetry-collector-fips, k8sgpt, istio,...

SUSE CVE-2026-42151

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

SUSE CVE-2026-42154

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a sma...

Linux Distros Unpatched Vulnerability : CVE-2026-42154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not...

PT-2026-38079

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a sma...

PT-2026-38078

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client secret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

Linux Distros Unpatched Vulnerability : CVE-2026-42151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write...

GHSA-FW8G-CG8F-9J28 Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Impact In the Prometheus server's legacy web UI enabled via the command-line flag --enable-feature=old-ui, the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics e.g. via a...

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Impact In the Prometheus server's legacy web UI enabled via the command-line flag --enable-feature=old-ui, the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics e.g. via a...

EUVD-2026-27091

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload...