ALSA-2026:34359 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Information...

RHEL 9 : opentelemetry-collector (RHSA-2026:34359)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34359 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus:...

ALSA-2026:34357 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Information...

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Information...

openSUSE 16 Security Update : golang-github-prometheus-alertmanager (openSUSE-SU-2026:21157-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21157-1 advisory. Changes in golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to versi...

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. This vulnerability exists because the global wrapMetrics middleware records the raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency a...

OPENSUSE-SU-2026:21184-1 Security update for coturn

This update for coturn fixes the following issues: Changes in coturn: - Update to version 4.14.0 New No more dependency on prometheus-client-c HTTPS support for prometheus client optional TLS support for redis - now compatible with managed redis optional. Rate limiting "401 Unauthorized" response...

Security update for golang-github-prometheus-alertmanager (moderate)

openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21136-1 Rating: moderate References: bsc1236516 bsc1238686 bsc1247748 Cross-References: CVE-2023-45288 CVE-2025-22870...

PT-2026-54445

Name of the Vulnerable Software and Affected Versions Sigstore Timestamp Authority versions prior to v2.0.7 Description An unauthenticated remote attacker can cause unbounded memory growth on the timestamp authority server. The issue occurs because the wrapMetrics middleware records the raw HTTP...

Security update for golang-github-prometheus-alertmanager (important)

openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21157-1 Rating: important References: bsc1266615 Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE :...

[SECURITY] Fedora 43 Update: prometheus-podman-exporter-1.21.1-1.fc43

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 44 Update: prometheus-podman-exporter-1.21.1-1.fc44

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

Fedora 43 : prometheus-podman-exporter (2026-460749ef95)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-460749ef95 advisory. release 1.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 44 : prometheus-podman-exporter (2026-3c6643b33a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3c6643b33a advisory. release 1.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-40011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: omnictl-multiarch, omnictl-multiarch-fips, apply-cve-bump, harbor-fips, knative-kafka-broker, prometheus-mongodb-exporter, istio, mattermost, argo-events, loki, kubernetes, containerd, gitlab-rails-ce, external-secrets-operator-fips, gitlab-workhorse-ce, zitadel,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, omnictl-multiarch-fips, kubescape-server, istio, cert-manager, seaweedfs-rocksdb, containerd, gitlab-rails-ce, grafana, cilium-cli, kuma, upwind-agent, vitess, minio, gitea-fips, calico-fips, flux-image-automation-controller-fips, zarf-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, nfpm, omnictl-multiarch-fips, kubescape-server, terraform-provider-tls-fips, tkn, crossplane-provider-azure-netapp, istio, cert-manager, argo-events, buildah, glab, melange, neuvector-sigstore-interface-fips, seaweedfs-rocksdb,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, omnictl-multiarch-fips, kubescape-server, istio, cert-manager, seaweedfs-rocksdb, containerd, gitlab-rails-ce, grafana, cilium-cli, kuma, upwind-agent, vitess, minio, gitea-fips, calico-fips, flux-image-automation-controller-fips, zarf-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, nfpm, omnictl-multiarch-fips, kubescape-server, terraform-provider-tls-fips, tkn, crossplane-provider-azure-netapp, istio, cert-manager, argo-events, buildah, glab, melange, neuvector-sigstore-interface-fips, seaweedfs-rocksdb,...