GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: chisel-fips, caddy-fips, crossplane-aws-provider-fips, crossplane-provider-azure-spring, kueue, apko, crossplane-provider-aws-route53recoverycontrolconfig, flux-notification-controller-fips, k3s, steampipe, crossplane-provider-aws-secretsmanager-fips, src,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: chisel-fips, caddy-fips, crossplane-aws-provider-fips, crossplane-provider-azure-spring, kueue, apko, crossplane-provider-aws-route53recoverycontrolconfig, flux-notification-controller-fips, k3s, steampipe, crossplane-provider-aws-secretsmanager-fips, src,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, terraform-fips, argo-workflows-fips, kube-conformance, tekton-pipelines-fips, cilium-cli, omnictl-multiarch, loki, argo-cd-fips, telegraf, opentofu-fips, terraform, gitlab-workhorse-ce-fips, k3s, grafana, frankenphp-8.4, prometheus,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: external-secrets-operator, k9s-fips, caddy-fips, dagger, go-discover-fips, argo-workflows-fips, terraform-fips, jfrog-cli, kube-conformance, tekton-pipelines-fips, cilium-cli, omnictl-multiarch, loki, flux-source-controller-fips, argocd-image-updater-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: external-secrets-operator, k9s-fips, chisel-fips, dagger, terraform-fips, argo-workflows-fips, longhorn-manager, jfrog-cli, kube-conformance, tekton-pipelines-fips, cilium-cli, omnictl-multiarch, loki, flux-source-controller-fips, argocd-image-updater-fips,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argo-workflows-fips, kube-conformance, tekton-pipelines-fips, cilium-cli, omnictl-multiarch, loki, argo-cd-fips, telegraf, opentofu-fips, terraform, gitlab-workhorse-ce-fips, k3s, grafana, frankenphp-8.4, prometheus, kube-state-metrics,...

GHSA-5CGQ-3RG8-M6CV vulnerabilities

Vulnerabilities for packages: istio, telegraf, gitsign, argocd-image-updater, containerd, k3s, mattermost, prometheus, terragrunt, guac, argo-events, falco-no-driver, external-secrets-operator...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: aactl, spire-server, telegraf, argocd-image-updater, external-dns, k3s, trivy-operator, kyverno, istio, prometheus, cloud-provider-aws, containerd, rancher, chisel, flux-source-controller, kaf, zarf, cert-manager, prometheus-operator, kubescape, mattermost, gitea,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: aactl, spire-server, telegraf, argocd-image-updater, external-dns, k3s, docker-machine-driver-harvester, trivy-operator, kyverno, istio, prometheus, cloud-provider-aws, containerd, rancher, chisel, flux-source-controller, kaf, zarf, cert-manager, prometheus-operator,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: aactl, melange, pulumi, argocd-image-updater, external-dns, k3s, spire-server, telegraf, opentofu, grype, dagger, trivy-operator, kyverno, gomplate, istio, act, prometheus, cloud-provider-aws, containerd, nfpm, pulumi-language-java, argo-events, flux-source-controlle...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: aactl, spire-server, telegraf, external-dns, k3s, buildah, kyverno, istio, prometheus, cloud-provider-aws, containerd, rancher, kaf, cert-manager, prometheus-operator, docker-cli-buildx, mattermost, opentelemetry-collector, helm, cilium-cli, podman, minio, kine,...

SUSE CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

GO-2026-5662 Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...

GO-2026-5381 Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus...

GO-2026-5264 Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus...

GO-2026-5215 Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator...

CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-40011

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-40011

CVE-2026-40011 describes a denial-of-service condition where sending a large number of crafted DNS queries can cause a dynamic block to be inserted with a value that yields invalid output on the Prometheus endpoint. The Prometheus data may then be rejected by the scraper until the dynamic block e...