GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-wafv2-fips, omnictl-multiarch-fips, kubescape-server, crossplane-provider-aws-directconnect-fips, crossplane-provider-aws-lexmodels, istio, argo-events, wolfictl, go-discover, gitlab-rails-ce, crossplane-provider-azure-web, cilium-cli,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-wafv2-fips, omnictl-multiarch-fips, kubescape-server, crossplane-provider-aws-directconnect-fips, crossplane-provider-aws-lexmodels, istio, argo-events, wolfictl, go-discover, gitlab-rails-ce, crossplane-provider-azure-web, cilium-cli,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: omnictl-multiarch-fips, istio, cert-manager, buildah, containerd, gitlab-rails-ce, grafana, cilium-cli, upwind-agent, vitess, minio, podman, calico-fips, kube-arangodb-fips, gitlab-rails-ce-fips, vault, frankenphp-8.3, flux, packer-fips, argo-workflows-fips,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: nfpm, omnictl-multiarch-fips, kubescape-server, istio, cert-manager, argo-events, buildah, wolfictl, melange, containerd, go-discover, gitlab-rails-ce, syft-fips, grafana, cilium-cli, kuma, upwind-agent, vitess, step, minio, gitea-fips, podman, pulumi-language-dotnet...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: omnictl-multiarch-fips, istio, cert-manager, buildah, containerd, gitlab-rails-ce, grafana, cilium-cli, upwind-agent, vitess, minio, podman, calico-fips, kube-arangodb-fips, gitlab-rails-ce-fips, vault, frankenphp-8.3, flux, argo-workflows-fips, knative-serving-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, nfpm, omnictl-multiarch-fips, kubescape-server, istio, wal-g, cert-manager, argo-events, seaweedfs-rocksdb, wolfictl, melange, containerd, rancher-machine, gitlab-rails-ce, syft-fips, grafana, cilium-cli, kuma, splunk-otel-collector,...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: mattermost, k3s, falco-no-driver, containerd, gitsign, external-secrets-operator, terragrunt, prometheus, argocd-image-updater, telegraf, argo-events, guac, istio...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: zot, aactl, flux, cert-manager, rancher, kine, containerd, gitea, kubescape, fscrypt, prometheus-operator, nerdctl, external-dns, falco-no-driver, cilium-cli, chisel, opentelemetry-collector, snyk-cli, flux-source-controller, osv-scanner, zarf,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: zot, aactl, docker-machine-driver-harvester, flux, cert-manager, rancher, kine, containerd, gitea, kubescape, fscrypt, prometheus-operator, nerdctl, external-dns, falco-no-driver, cilium-cli, chisel, opentelemetry-collector, snyk-cli, flux-source-controller,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: zot, aactl, flux, cert-manager, gptscript, dagger, kine, containerd, gitea, kubescape, scorecard, melange, fscrypt, wolfictl, prometheus-operator, gomplate, nerdctl, podman, external-dns, falco-no-driver, cilium-cli, opentelemetry-collector, snyk-cli,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: zot, aactl, flux, cert-manager, rancher, kine, containerd, fscrypt, docker-cli-buildx, prometheus-operator, nerdctl, podman, external-dns, falco-no-driver, cilium-cli, opentelemetry-collector, snyk-cli, external-secrets-operator, kyverno, minio, helm, mattermost,...

SUSE CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...

GO-2026-5662 Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus...

GO-2026-5381 Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus...

GO-2026-5264 Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus...

GO-2026-5215 Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator...

CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-40011

CVE-2026-40011 describes a denial-of-service condition where sending a large number of crafted DNS queries can cause a dynamic block to be inserted with a value that yields invalid output on the Prometheus endpoint. The Prometheus data may then be rejected by the scraper until the dynamic block e...