CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

EUVD-2026-63474

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

PT-2026-79061

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

EUVD-2026-59772

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

CVE-2026-19898

CVE-2026-19898 affects VictoriaMetrics up to version 1.146.0, specifically the VMAuth Authentication Endpoint (file app/vmauth/main.go, function requestHandler). A manipulation can lead to improper restriction of excessive authentication attempts, with remote attack possibility. The exploit is de...

CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

GO-2025-4161 vulnerabilities

Vulnerabilities for packages: victoriametrics-operator-fips, victorialogs, victorialogs-fips...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, flux-source-controller, aws-ebs-csi-driver-fips, flux-image-automation-controller, temporal-fips, flux-notification-controller, victoriametrics-fips, flux-image-reflector-controller, librechat, amazon-k8s-cni-fips, grafana-rollout-operator,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster, flux-source-controller, dkron, flux-image-reflector-controller, go, flux-notification-controller, steampipe, polaris, victoriametrics, pluto, flux-image-automation-controller, metacontroller, terragrunt, flux-helm-controller, stakater-reloade...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster, flux-source-controller, dkron, flux-image-reflector-controller, go, flux-notification-controller, steampipe, polaris, victoriametrics, pluto, flux-image-automation-controller, metacontroller, terragrunt, flux-helm-controller, stakater-reloade...

GO-2026-4866 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, spire-server, ingress-nginx-controller, newrelic-infra-operator, kubewatch, external-secrets-operator, victoriametrics-cluster, oras, envoy-ratelimit, hubble, malcontent, clickhouse-operator, nfs-subdir-external-provisioner,...

CLEANSTART-2026-CZ42284 Security fixes in victoriametrics-operator 0.72.0-r1

Package victoriametrics-operator version 0.72.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-ER59632 Security fixes in victoriametrics-operator 0.71.0-r1

Package victoriametrics-operator version 0.71.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-HS77703 Security fixes in victoriametrics-operator 0.72.0-r2

Package victoriametrics-operator version 0.72.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-FV97418 Security fixes in victoriametrics-operator 0.71.0-r2

Package victoriametrics-operator version 0.71.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-QM89803 Security fixes in victoriametrics-operator-fips 0.65.0-r1

Package victoriametrics-operator-fips version 0.65.0-r1 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-FL92445 Security fixes in victoriametrics-cluster 1.132.0-r0

Package victoriametrics-cluster version 1.132.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-JD71154 Security fixes in victoriametrics-operator-fips 0.65.0-r2

Package victoriametrics-operator-fips version 0.65.0-r2 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, ghsa-9h8m-3fm2-qjrq, CVE-2026-27139...

CLEANSTART-2026-PH84276 Security fixes for CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507 applied in versions: 1.138.0-r0

Multiple security vulnerabilities affect the victoriametrics-vmauth package. These issues are resolved in later releases. See references for individual vulnerability details...