Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.3.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-fips, goose-fips, apko, ratify-fips, vault-fips, minio, rekor, ksops, mattermost-fips, spicedb-fips, kyverno-fips, certificate-transparency, nri-mysql, croc, caddy-fips, keda, step-kms-plugin-fips, chezmoi, trillian, temporal-server-fips, grafana-alloy,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: sftpgo, step-kms-plugin, openbao, amass, nri-mysql, fulcio, sftpgo-plugin-eventstore, step-ca, telegraf, witness, certificate-transparency, flux-kustomize-controller, trillian, crossplane-provider-sql, timestamp-authority, k3s, sops, sqlexporter, tailscale, step,...

openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20239-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20239-1 advisory. - CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. bsc1257841 - CVE-2026-1615: Fixed...

Security update for golang-github-prometheus-prometheus (critical)

openSUSE security update: security update for golang-github-prometheus-prometheus ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20239-1 Rating: critical References: bsc1257442 bsc1257841 bsc1257897 Cross-References: CVE-2025-61140 CVE-2026-1615...

SUSE-SU-2026:20574-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. bsc1257841 - CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Pat...

CVE-2026-26069

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

CLEANSTART-2026-TR92727 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the prometheus-operator-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should ha...

CLEANSTART-2026-JB30245 Security fixes for GHSA-F6X5-JH6R-WRFV, GHSA-J5W8-Q4QC-RX2X applied in versions: 0.47.2-r0

Multiple security vulnerabilities affect the prometheus-mongodb-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...

SUSE: Security Advisory (SUSE-SU-2026:20232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-26069

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

CVE-2026-26069

Scraparr (Prometheus Exporter) prior to 3.0.2 is affected when Readarr integration is enabled and the exporter’s /metrics is exposed to outsiders. The Readarr API key could be exposed as the alias metric label value, under conditions: Readarr scraping enabled, no alias configured, /metrics public...

CVE-2026-26069 Scraparr Readarr Integration exposes sensitive values as metric labels.

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

[SECURITY] Fedora 42 Update: rust-monitord-exporter-0.4.1-8.fc42

monitord-exporter is a Prometheus exporter using monitord to export statistic to Prometheus collectors...

CLEANSTART-2026-LS08172 Within HostnameError

Multiple security vulnerabilities affect the prometheus-fips package. Within HostnameError. See references for individual vulnerability details...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: secretgen-controller, cyberark-secrets-provider-for-k8s, kubernetes-dashboard-web, haproxy-ingress, shfmt, nfpm, flux-image-reflector-controller-fips, ratify-fips, vault-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, kubernetes-csi-external-health-monitor,...