Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-44903 (GCVE-0-2026-44903)
Vulnerability from cvelistv5 – Published: 2026-05-26 21:27 – Updated: 2026-05-27 14:20
VLAI
EPSS
VEX
Title
Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
Summary
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-27 14:19 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prometheus/prometheus/security… | x_refsource_CONFIRM |
| https://github.com/prometheus/prometheus/commit/3… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| prometheus | prometheus |
Affected:
>= 2.49.0, < 3.5.3
Affected: >= 3.6.0-rc.0, < 3.11.3 |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44903",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T14:19:11.558921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T14:20:35.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prometheus",
"vendor": "prometheus",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.49.0, \u003c 3.5.3"
},
{
"status": "affected",
"version": "\u003e= 3.6.0-rc.0, \u003c 3.11.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server\u0027s legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T21:27:18.597Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28"
},
{
"name": "https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d"
}
],
"source": {
"advisory": "GHSA-fw8g-cg8f-9j28",
"discovery": "UNKNOWN"
},
"title": "Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44903",
"datePublished": "2026-05-26T21:27:18.597Z",
"dateReserved": "2026-05-07T21:50:33.547Z",
"dateUpdated": "2026-05-27T14:20:35.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-44903",
"date": "2026-08-28",
"epss": "0.00204",
"percentile": "0.10356"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-44903\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-26T22:16:43.010\",\"lastModified\":\"2026-07-24T12:10:00.210\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server\u0027s legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.\"},{\"lang\":\"es\",\"value\":\"Prometheus es un sistema de monitoreo de c\u00f3digo abierto y una base de datos de series temporales. Desde 2.49.0 hasta antes de 3.5.3 y 3.11.3, en la interfaz de usuario web heredada del servidor de Prometheus (habilitada a trav\u00e9s del indicador de l\u00ednea de comandos --enable-feature=old-ui), la vista del gr\u00e1fico de mapa de calor de histograma no escapa los valores de las etiquetas al insertarlos en el HTML para usarlos como etiquetas de marcas de graduaci\u00f3n del eje. Un atacante que puede inyectar m\u00e9tricas manipuladas puede ejecutar JavaScript en el navegador de cualquier usuario de Prometheus que vea la m\u00e9trica en la interfaz de usuario del gr\u00e1fico de mapa de calor. Esta vulnerabilidad se corrige en 3.5.3 y 3.11.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"prometheus\",\"product\":\"prometheus\",\"versions\":[{\"version\":\"\u003e= 2.49.0, \u003c 3.5.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.6.0-rc.0, \u003c 3.11.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-27T14:19:11.558921Z\",\"id\":\"CVE-2026-44903\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.49.0\",\"versionEndExcluding\":\"3.5.3\",\"matchCriteriaId\":\"E6C529E9-6035-4548-A2A9-26AADB0E0965\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndExcluding\":\"3.11.3\",\"matchCriteriaId\":\"26BB9EEC-D049-4268-953C-E90B253745CE\"}]}]}],\"references\":[{\"url\":\"https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-06-05T19:25:08+00:00",
"cve": "CVE-2026-44903",
"id": "CVE-2026-44903",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44903.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44903\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-27T14:19:11.558921Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-27T14:20:32.176Z\"}}], \"cna\": {\"title\": \"Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI\", \"source\": {\"advisory\": \"GHSA-fw8g-cg8f-9j28\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"prometheus\", \"product\": \"prometheus\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.49.0, \u003c 3.5.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.6.0-rc.0, \u003c 3.11.3\"}]}], \"references\": [{\"url\": \"https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28\", \"name\": \"https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d\", \"name\": \"https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server\u0027s legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-26T21:27:18.597Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-44903\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-27T14:20:35.919Z\", \"dateReserved\": \"2026-05-07T21:50:33.547Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-26T21:27:18.597Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cleanstart-2026-uo11850
Vulnerability from cleanstart
Published
2026-06-08 12:38
Modified
2026-06-05 10:47
Summary
Security fixes for CVE-2024-24786, CVE-2024-35255, CVE-2025-22868, CVE-2025-30204, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-42504, CVE-2026-42507, CVE-2026-44903, CVE-2026-46598, ghsa-8rm2-7qqf-34qm, ghsa-fw8g-cg8f-9j28, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 0.69.1-r0, 0.69.1-r1, 0.69.1-r2, 0.69.1-r3, 0.87.1-r0, 0.89.0-r0
Details
Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.89.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-UO11850",
"modified": "2026-06-05T10:47:49Z",
"published": "2026-06-08T12:38:40.185129Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UO11850.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2024-24786"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2024-35255"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-22868"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-30204"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61726"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61728"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61730"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61731"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61732"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-68119"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-68121"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25679"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27139"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27142"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27143"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27144"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27145"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32280"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32281"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32282"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32283"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32288"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32289"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33810"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33814"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39817"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39819"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39820"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39823"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39825"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39826"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39836"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-40179"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42154"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42499"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42501"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42504"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42507"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-46598"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8rm2-7qqf-34qm"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vffh-x6r8-xx99"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22868"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30204"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61730"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61731"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68119"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27142"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32288"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32289"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40179"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2024-24786, CVE-2024-35255, CVE-2025-22868, CVE-2025-30204, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-42504, CVE-2026-42507, CVE-2026-44903, CVE-2026-46598, ghsa-8rm2-7qqf-34qm, ghsa-fw8g-cg8f-9j28, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 0.69.1-r0, 0.69.1-r1, 0.69.1-r2, 0.69.1-r3, 0.87.1-r0, 0.89.0-r0",
"upstream": [
"CVE-2024-24786",
"CVE-2024-35255",
"CVE-2025-22868",
"CVE-2025-30204",
"CVE-2025-61726",
"CVE-2025-61728",
"CVE-2025-61730",
"CVE-2025-61731",
"CVE-2025-61732",
"CVE-2025-68119",
"CVE-2025-68121",
"CVE-2026-25679",
"CVE-2026-27139",
"CVE-2026-27140",
"CVE-2026-27142",
"CVE-2026-27143",
"CVE-2026-27144",
"CVE-2026-27145",
"CVE-2026-32280",
"CVE-2026-32281",
"CVE-2026-32282",
"CVE-2026-32283",
"CVE-2026-32288",
"CVE-2026-32289",
"CVE-2026-33810",
"CVE-2026-33811",
"CVE-2026-33814",
"CVE-2026-39817",
"CVE-2026-39819",
"CVE-2026-39820",
"CVE-2026-39823",
"CVE-2026-39825",
"CVE-2026-39826",
"CVE-2026-39836",
"CVE-2026-40179",
"CVE-2026-42151",
"CVE-2026-42154",
"CVE-2026-42499",
"CVE-2026-42501",
"CVE-2026-42504",
"CVE-2026-42507",
"CVE-2026-44903",
"CVE-2026-46598",
"ghsa-8rm2-7qqf-34qm",
"ghsa-fw8g-cg8f-9j28",
"ghsa-vffh-x6r8-xx99",
"ghsa-wg65-39gg-5wfj"
]
}
cleanstart-2026-xa19321
Vulnerability from cleanstart
Published
2026-07-30 07:10
Modified
2026-07-30 09:34
Summary
Security fixes in istio-fips 1.30.0-r0
Details
Package istio-fips version 1.30.0-r0 fixes 10 vulnerabilities: CVE-2026-35469, ghsa-pc3f-x583-g7j2, CVE-2026-44903, CVE-2026-40179, CVE-2026-42154...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "istio-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.30.0-r0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.30.0-r0"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package istio-fips version 1.30.0-r0 fixes 10 vulnerabilities: CVE-2026-35469, ghsa-pc3f-x583-g7j2, CVE-2026-44903, CVE-2026-40179, CVE-2026-42154...",
"id": "CLEANSTART-2026-XA19321",
"modified": "2026-07-30T09:34:58Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/istio/istio"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in istio-fips 1.30.0-r0",
"upstream": [
"CVE-2026-35469",
"ghsa-pc3f-x583-g7j2",
"CVE-2026-44903",
"CVE-2026-40179",
"CVE-2026-42154",
"CVE-2026-42151",
"ghsa-fw8g-cg8f-9j28",
"ghsa-vffh-x6r8-xx99",
"ghsa-wg65-39gg-5wfj",
"ghsa-8rm2-7qqf-34qm"
]
}
cleanstart-2026-xs03563
Vulnerability from cleanstart
Published
2026-07-21 09:10
Modified
2026-07-01 06:11
Summary
Security fixes for CVE-2025-15558, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-44903, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-8rm2-7qqf-34qm, ghsa-fw8g-cg8f-9j28, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 1.29.0-r0, 1.29.0-r1, 1.29.1-r0, 1.29.2-r0, 1.29.2-r1, 1.29.2-r2
Details
Multiple security vulnerabilities affect the istio package. These issues are resolved in later releases. See references for individual vulnerability details.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "istio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.2-r2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the istio package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-XS03563",
"modified": "2026-07-01T06:11:22Z",
"published": "2026-07-21T09:10:57.180248Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XS03563.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-15558"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25680"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25681"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27136"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27145"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33186"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33814"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-35469"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39817"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39819"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39820"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39821"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39823"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39824"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39825"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39826"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39827"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39828"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39829"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39830"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39831"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39832"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39833"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39834"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39835"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39836"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-40179"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42154"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42499"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42501"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42502"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42504"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42506"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42507"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42508"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-46595"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-46597"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-46598"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8rm2-7qqf-34qm"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p436-gjf2-799p"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p77j-4mvh-x3m3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vffh-x6r8-xx99"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15558"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25680"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35469"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39824"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40179"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42506"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-15558, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-44903, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-8rm2-7qqf-34qm, ghsa-fw8g-cg8f-9j28, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 1.29.0-r0, 1.29.0-r1, 1.29.1-r0, 1.29.2-r0, 1.29.2-r1, 1.29.2-r2",
"upstream": [
"CVE-2025-15558",
"CVE-2026-25680",
"CVE-2026-25681",
"CVE-2026-27136",
"CVE-2026-27145",
"CVE-2026-33186",
"CVE-2026-33811",
"CVE-2026-33814",
"CVE-2026-35469",
"CVE-2026-39817",
"CVE-2026-39819",
"CVE-2026-39820",
"CVE-2026-39821",
"CVE-2026-39823",
"CVE-2026-39824",
"CVE-2026-39825",
"CVE-2026-39826",
"CVE-2026-39827",
"CVE-2026-39828",
"CVE-2026-39829",
"CVE-2026-39830",
"CVE-2026-39831",
"CVE-2026-39832",
"CVE-2026-39833",
"CVE-2026-39834",
"CVE-2026-39835",
"CVE-2026-39836",
"CVE-2026-40179",
"CVE-2026-42151",
"CVE-2026-42154",
"CVE-2026-42499",
"CVE-2026-42501",
"CVE-2026-42502",
"CVE-2026-42504",
"CVE-2026-42506",
"CVE-2026-42507",
"CVE-2026-42508",
"CVE-2026-44903",
"CVE-2026-46595",
"CVE-2026-46597",
"CVE-2026-46598",
"ghsa-8rm2-7qqf-34qm",
"ghsa-fw8g-cg8f-9j28",
"ghsa-p436-gjf2-799p",
"ghsa-p77j-4mvh-x3m3",
"ghsa-vffh-x6r8-xx99",
"ghsa-wg65-39gg-5wfj"
]
}
cleanstart-2026-yp95633
Vulnerability from cleanstart
Published
2026-07-30 07:10
Modified
2026-07-30 09:39
Summary
Security fixes in grafana 12.2.10-r1
Details
Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "grafana"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.10-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.2.10-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...",
"id": "CLEANSTART-2026-YP95633",
"modified": "2026-07-30T09:39:02Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://grafana.com"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in grafana 12.2.10-r1",
"upstream": [
"ghsa-p4r4-xvrq-gvmc",
"ghsa-ffqx-q65f-36jf",
"CVE-2026-21728",
"CVE-2026-28377",
"ghsa-wg65-39gg-5wfj",
"ghsa-fw8g-cg8f-9j28",
"CVE-2026-42151",
"CVE-2026-44903",
"ghsa-cp6g-7hqx-qxhp",
"CVE-2026-2303",
"ghsa-8396-jffm-qx4w",
"CVE-2026-48096",
"ghsa-w8rr-5gcm-pp58"
]
}
cleanstart-2026-zt61417
Vulnerability from cleanstart
Published
2026-08-13 12:10
Modified
2026-08-14 05:57
Summary
Security fixes in tempo 2.10.4-r1
Details
Package tempo version 2.10.4-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39832...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "tempo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.4-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.10.4-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package tempo version 2.10.4-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39832...",
"id": "CLEANSTART-2026-ZT61417",
"modified": "2026-08-14T05:57:42Z",
"published": "2026-08-13T12:10:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grafana/tempo"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in tempo 2.10.4-r1",
"upstream": [
"CVE-2026-39827",
"CVE-2026-39828",
"CVE-2026-39829",
"CVE-2026-39830",
"CVE-2026-39832",
"CVE-2026-39835",
"CVE-2026-42508",
"CVE-2026-46595",
"CVE-2026-46597",
"CVE-2026-39831",
"CVE-2026-39833",
"CVE-2026-39834",
"CVE-2026-46598",
"CVE-2026-25681",
"CVE-2026-27136",
"CVE-2026-33814",
"CVE-2026-39821",
"CVE-2026-42502",
"CVE-2026-25680",
"CVE-2026-42506",
"ghsa-5cv4-jp36-h3mw",
"CVE-2026-39824",
"CVE-2026-42151",
"CVE-2026-42154",
"CVE-2026-44903",
"ghsa-8rm2-7qqf-34qm",
"ghsa-wg65-39gg-5wfj",
"ghsa-fw8g-cg8f-9j28",
"CVE-2026-41602",
"ghsa-wf45-q9ch-q8gh",
"CVE-2026-2303",
"ghsa-cp6g-7hqx-qxhp"
]
}
cleanstart-2026-zz38071
Vulnerability from cleanstart
Published
2026-07-21 09:18
Modified
2026-06-30 13:20
Summary
Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1
Details
Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "grafana"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.10-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-ZZ38071",
"modified": "2026-06-30T13:20:18Z",
"published": "2026-07-21T09:18:39.114090Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZZ38071.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-21728"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2303"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-28377"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-48096"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8396-jffm-qx4w"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-ffqx-q65f-36jf"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-fw8g-cg8f-9j28"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p4r4-xvrq-gvmc"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wg65-39gg-5wfj"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2303"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28377"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48096"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1",
"upstream": [
"CVE-2026-21728",
"CVE-2026-2303",
"CVE-2026-28377",
"CVE-2026-42151",
"CVE-2026-44903",
"CVE-2026-48096",
"ghsa-8396-jffm-qx4w",
"ghsa-ffqx-q65f-36jf",
"ghsa-fw8g-cg8f-9j28",
"ghsa-p4r4-xvrq-gvmc",
"ghsa-w8rr-5gcm-pp58",
"ghsa-wg65-39gg-5wfj"
]
}
FKIE_CVE-2026-44903
Vulnerability from fkie_nvd - Published: 2026-05-26 22:16 - Updated: 2026-07-24 12:10
Severity
Summary
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| prometheus | prometheus | * | |
| prometheus | prometheus | * |
{
"affected": [
{
"affectedData": [
{
"product": "prometheus",
"vendor": "prometheus",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.49.0, \u003c 3.5.3"
},
{
"status": "affected",
"version": "\u003e= 3.6.0-rc.0, \u003c 3.11.3"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6C529E9-6035-4548-A2A9-26AADB0E0965",
"versionEndExcluding": "3.5.3",
"versionStartIncluding": "2.49.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
"matchCriteriaId": "26BB9EEC-D049-4268-953C-E90B253745CE",
"versionEndExcluding": "3.11.3",
"versionStartIncluding": "3.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server\u0027s legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3."
},
{
"lang": "es",
"value": "Prometheus es un sistema de monitoreo de c\u00f3digo abierto y una base de datos de series temporales. Desde 2.49.0 hasta antes de 3.5.3 y 3.11.3, en la interfaz de usuario web heredada del servidor de Prometheus (habilitada a trav\u00e9s del indicador de l\u00ednea de comandos --enable-feature=old-ui), la vista del gr\u00e1fico de mapa de calor de histograma no escapa los valores de las etiquetas al insertarlos en el HTML para usarlos como etiquetas de marcas de graduaci\u00f3n del eje. Un atacante que puede inyectar m\u00e9tricas manipuladas puede ejecutar JavaScript en el navegador de cualquier usuario de Prometheus que vea la m\u00e9trica en la interfaz de usuario del gr\u00e1fico de mapa de calor. Esta vulnerabilidad se corrige en 3.5.3 y 3.11.3."
}
],
"id": "CVE-2026-44903",
"lastModified": "2026-07-24T12:10:00.210",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-44903",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T14:19:11.558921Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-26T22:16:43.010",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d"
},
{
"source": "security-advisories@github.com",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-FW8G-CG8F-9J28
Vulnerability from github – Published: 2026-05-05 21:53 – Updated: 2026-06-08 23:34
VLAI
Summary
Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display
Details
Impact
In the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels.
An attacker who can inject crafted metrics (e.g. via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. From the XSS context, an attacker could for example:
- Read
/api/v1/status/configto extract sensitive configuration (although credentials / secrets are redacted by the server) - Call
/-/quitto shut down Prometheus (only if--web.enable-lifecycleis set) - Call
/api/v1/admin/tsdb/delete_seriesto delete data (only if--web.enable-admin-apiis set) - Exfiltrate metric data to an external server
Note that this only affects users who have explicitly enabled the legacy Prometheus web UI using the --enable-feature=old-ui command-line flag.
Patches
https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d
Workarounds
If at all possible, disable the legacy web UI by removing the --enable-feature=old-ui command-line flag).
If this is not an option, take the following precautions:
- If using the remote write receiver (
--web.enable-remote-write-receiver), ensure it is not exposed to untrusted sources. - If using the OTLP receiver (
--web.enable-otlp-receiver), ensure it is not exposed to untrusted sources. - Ensure scrape targets are trusted and not under attacker control.
- Do not enable admin / mutating API endpoints (e.g.
--web.enable-admin-apiorweb.enable-lifecycle) in cases where you cannot prevent untrusted data from being ingested. - Users should avoid clicking untrusted links, especially those containing functions such as
label_replace, as they may generate poisoned label names and values.
References
- CVE-2019-10215 — prior stored DOM XSS vulnerability in Prometheus query history, fixed in v2.7.2
- CVE-2026-40179 — prior stored DOM XSS vulnerability in Prometheus web UI (hover tooltips and metrics explorer), fixed in v3.11.2
Severity
6.1 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/prometheus/prometheus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.311.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44903"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T21:53:18Z",
"nvd_published_at": "2026-05-26T22:16:43Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nIn the Prometheus server\u0027s legacy web UI (enabled via the command-line flag `--enable-feature=old-ui`), the histogram heatmap chart view does not escape `le` label values when inserting them into the HTML for use as axis tick mark labels.\n\nAn attacker who can inject crafted metrics (e.g. via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. From the XSS context, an attacker could for example:\n\n- Read `/api/v1/status/config` to extract sensitive configuration (although credentials / secrets are redacted by the server)\n- Call `/-/quit` to shut down Prometheus (only if `--web.enable-lifecycle` is set)\n- Call `/api/v1/admin/tsdb/delete_series` to delete data (only if `--web.enable-admin-api` is set)\n- Exfiltrate metric data to an external server\n\nNote that this only affects users who have explicitly enabled the legacy Prometheus web UI using the `--enable-feature=old-ui` command-line flag.\n\n### Patches\n\nhttps://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d\n\n### Workarounds\n\nIf at all possible, disable the legacy web UI by removing the `--enable-feature=old-ui` command-line flag).\n\nIf this is not an option, take the following precautions:\n\n- If using the remote write receiver (`--web.enable-remote-write-receiver`), ensure it is not exposed to untrusted sources.\n- If using the OTLP receiver (`--web.enable-otlp-receiver`), ensure it is not exposed to untrusted sources.\n- Ensure scrape targets are trusted and not under attacker control.\n- Do not enable admin / mutating API endpoints (e.g. `--web.enable-admin-api` or `web.enable-lifecycle`) in cases where you cannot prevent untrusted data from being ingested.\n- Users should avoid clicking untrusted links, especially those containing functions such as `label_replace`, as they may generate poisoned label names and values.\n\n### References\n\n- CVE-2019-10215 \u2014 prior stored DOM XSS vulnerability in Prometheus query history, fixed in v2.7.2\n- CVE-2026-40179 \u2014 prior stored DOM XSS vulnerability in Prometheus web UI (hover tooltips and metrics explorer), fixed in v3.11.2",
"id": "GHSA-fw8g-cg8f-9j28",
"modified": "2026-06-08T23:34:45Z",
"published": "2026-05-05T21:53:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44903"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d"
},
{
"type": "PACKAGE",
"url": "https://github.com/prometheus/prometheus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display"
}
ubuntu-cve-2026-44903
Vulnerability from osv_ubuntu
Published
2026-05-26 22:16
Modified
2026-07-02 16:14
Summary
Details
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
Severity
6.1 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "prometheus",
"binary_version": "0.16.2+ds-1ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@0.16.2+ds-1ubuntu1?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.14.0+ds-1",
"0.16.2+ds-1",
"0.16.2+ds-1ubuntu1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "prometheus",
"binary_version": "2.1.0+ds-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.1.0+ds-1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.7.1+ds-1",
"1.8.1+ds-2",
"2.1.0+ds-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "prometheus",
"binary_version": "2.15.2+ds-2"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.15.2+ds-2?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.7.1+ds-3",
"2.15.2+ds-2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "prometheus",
"binary_version": "2.31.2+ds1-1ubuntu1.22.04.3+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.31.2+ds1-1ubuntu1.22.04.3+esm3?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.24.1+ds-1ubuntu1",
"2.24.1+ds-1ubuntu2",
"2.31.1+ds2-2",
"2.31.2+ds1-1",
"2.31.2+ds1-1ubuntu1",
"2.31.2+ds1-1ubuntu1.22.04.1",
"2.31.2+ds1-1ubuntu1.22.04.2",
"2.31.2+ds1-1ubuntu1.22.04.3",
"2.31.2+ds1-1ubuntu1.22.04.3+esm1",
"2.31.2+ds1-1ubuntu1.22.04.3+esm2",
"2.31.2+ds1-1ubuntu1.22.04.3+esm3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "prometheus",
"binary_version": "2.45.3+ds-2ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.45.3+ds-2ubuntu0.3+esm2?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.45.0+ds-3build1",
"2.45.1+ds-1",
"2.45.1+ds-2",
"2.45.1+ds-3",
"2.45.3+ds-2",
"2.45.3+ds-2build1",
"2.45.3+ds-2ubuntu0.1",
"2.45.3+ds-2ubuntu0.2",
"2.45.3+ds-2ubuntu0.2+esm1",
"2.45.3+ds-2ubuntu0.2+esm2",
"2.45.3+ds-2ubuntu0.3",
"2.45.3+ds-2ubuntu0.3+esm1",
"2.45.3+ds-2ubuntu0.3+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-prometheus-prometheus-dev",
"binary_version": "2.53.3+ds1-2"
},
{
"binary_name": "prometheus",
"binary_version": "2.53.3+ds1-2"
},
{
"binary_name": "promtool",
"binary_version": "2.53.3+ds1-2"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.53.3+ds1-2?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.53.3+ds1-1",
"2.53.3+ds1-2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-prometheus-prometheus-dev",
"binary_version": "2.53.5+ds1-3ubuntu0.26.04.1~esm1"
},
{
"binary_name": "prometheus",
"binary_version": "2.53.5+ds1-3ubuntu0.26.04.1~esm1"
},
{
"binary_name": "promtool",
"binary_version": "2.53.5+ds1-3ubuntu0.26.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:26.04:LTS",
"name": "prometheus",
"purl": "pkg:deb/ubuntu/prometheus@2.53.5+ds1-3ubuntu0.26.04.1~esm1?arch=source\u0026distro=esm-apps/resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.53.3+ds1-2",
"2.53.5+ds1-2",
"2.53.5+ds1-3",
"2.53.5+ds1-3ubuntu0.26.04.1~esm1"
]
}
],
"aliases": [],
"details": "Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server\u0027s legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.",
"id": "UBUNTU-CVE-2026-44903",
"modified": "2026-07-02T16:14:46Z",
"published": "2026-05-26T22:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-44903"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44903"
},
{
"type": "REPORT",
"url": "https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d"
},
{
"type": "REPORT",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-44903"
]
}
WID-SEC-W-2026-1292
Vulnerability from csaf_certbund - Published: 2026-04-27 22:00 - Updated: 2026-08-05 22:00Summary
Prometheus: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Prometheus ist ein Open-Source Monitoring- und Reporting-Tool.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Prometheus ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat OpenShift Container Platform
Red Hat / OpenShift
|
cpe:/a:redhat:openshift:container_platform
|
Container Platform | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Microsoft Azure Linux azl3
Microsoft / Azure Linux
|
cpe:/o:microsoft:azure_linux:azl3
|
azl3 | |
|
Red Hat OpenShift Container Platform <4.22.4
Red Hat / OpenShift
|
Container Platform <4.22.4 | ||
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Open Source Prometheus <3.5.3
Open Source / Prometheus
|
<3.5.3 | ||
|
Open Source Prometheus <3.11.3
Open Source / Prometheus
|
<3.11.3 |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat OpenShift Container Platform
Red Hat / OpenShift
|
cpe:/a:redhat:openshift:container_platform
|
Container Platform | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Microsoft Azure Linux azl3
Microsoft / Azure Linux
|
cpe:/o:microsoft:azure_linux:azl3
|
azl3 | |
|
Red Hat OpenShift Container Platform <4.22.4
Red Hat / OpenShift
|
Container Platform <4.22.4 | ||
|
Open Source Prometheus >=2.49.0
Open Source / Prometheus
|
>=2.49.0 | ||
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Open Source Prometheus <3.5.3
Open Source / Prometheus
|
<3.5.3 | ||
|
Open Source Prometheus <3.11.3
Open Source / Prometheus
|
<3.11.3 |
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat OpenShift Container Platform
Red Hat / OpenShift
|
cpe:/a:redhat:openshift:container_platform
|
Container Platform | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Microsoft Azure Linux azl3
Microsoft / Azure Linux
|
cpe:/o:microsoft:azure_linux:azl3
|
azl3 | |
|
Red Hat OpenShift Container Platform <4.22.4
Red Hat / OpenShift
|
Container Platform <4.22.4 | ||
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Open Source Prometheus <3.5.3
Open Source / Prometheus
|
<3.5.3 | ||
|
Open Source Prometheus <3.11.3
Open Source / Prometheus
|
<3.11.3 |
References
40 references
| URL | Category |
|---|---|
| https://wid.cert-bund.de/.well-known/csaf/white/2… | self |
| https://wid.cert-bund.de/portal/wid/securityadvis… | self |
| https://github.com/prometheus/prometheus/security… | external |
| https://github.com/prometheus/prometheus/security… | external |
| https://github.com/prometheus/prometheus/security… | external |
| https://lists.opensuse.org/archives/list/security… | external |
| https://msrc.microsoft.com/update-guide/ | external |
| https://lists.suse.com/pipermail/sle-security-upd… | external |
| https://access.redhat.com/errata/RHSA-2026:29770 | external |
| https://access.redhat.com/errata/RHSA-2026:25504 | external |
| https://access.redhat.com/errata/RHSA-2026:25245 | external |
| https://access.redhat.com/errata/RHSA-2026:30651 | external |
| https://access.redhat.com/errata/RHSA-2026:34364 | external |
| https://errata.build.resf.org/RLSA-2026:34357 | external |
| https://access.redhat.com/errata/RHSA-2026:36796 | external |
| https://access.redhat.com/errata/RHSA-2026:37272 | external |
| https://access.redhat.com/errata/RHSA-2026:37271 | external |
| https://access.redhat.com/errata/RHSA-2026:37267 | external |
| https://access.redhat.com/errata/RHSA-2026:34794 | external |
| https://access.redhat.com/errata/RHSA-2026:40118 | external |
| https://access.redhat.com/errata/RHSA-2026:40262 | external |
| https://access.redhat.com/errata/RHSA-2026:40945 | external |
| https://access.redhat.com/errata/RHSA-2026:42146 | external |
| https://access.redhat.com/errata/RHSA-2026:40768 | external |
| https://access.redhat.com/errata/RHSA-2026:42852 | external |
| https://access.redhat.com/errata/RHSA-2026:43052 | external |
| https://access.redhat.com/errata/RHSA-2026:42796 | external |
| https://access.redhat.com/errata/RHSA-2026:40792 | external |
| https://access.redhat.com/errata/RHSA-2026:44622 | external |
| https://access.redhat.com/errata/RHSA-2026:47149 | external |
| https://access.redhat.com/errata/RHSA-2026:44263 | external |
| https://access.redhat.com/errata/RHSA-2026:47952 | external |
| https://access.redhat.com/errata/RHSA-2026:44235 | external |
| https://access.redhat.com/errata/RHSA-2026:48771 | external |
| https://access.redhat.com/errata/RHSA-2026:49767 | external |
| https://access.redhat.com/errata/RHSA-2026:48699 | external |
| https://access.redhat.com/errata/RHSA-2026:50888 | external |
| https://access.redhat.com/errata/RHSA-2026:50874 | external |
| https://access.redhat.com/errata/RHSA-2026:50843 | external |
| https://access.redhat.com/errata/RHSA-2026:47728 | external |
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Prometheus ist ein Open-Source Monitoring- und Reporting-Tool.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Prometheus ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1292 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1292.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1292 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1292"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-8rm2-7qqf-34qm vom 2026-04-27",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-wg65-39gg-5wfj vom 2026-04-27",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-fw8g-cg8f-9j28 vom 2026-04-27",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:10676-1 vom 2026-05-05",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MULRNEZWDZWOTGUCTGRNS5XADFXA5LGU/"
},
{
"category": "external",
"summary": "Microsoft Security Update Guide vom 2026-05-12",
"url": "https://msrc.microsoft.com/update-guide/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:2267-1 vom 2026-06-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026577.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:29770 vom 2026-06-27",
"url": "https://access.redhat.com/errata/RHSA-2026:29770"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:25504 vom 2026-06-28",
"url": "https://access.redhat.com/errata/RHSA-2026:25504"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:25245 vom 2026-06-27",
"url": "https://access.redhat.com/errata/RHSA-2026:25245"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:30651 vom 2026-06-28",
"url": "https://access.redhat.com/errata/RHSA-2026:30651"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:34364 vom 2026-07-01",
"url": "https://access.redhat.com/errata/RHSA-2026:34364"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:34357 vom 2026-07-07",
"url": "https://errata.build.resf.org/RLSA-2026:34357"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:36796 vom 2026-07-08",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:37272 vom 2026-07-09",
"url": "https://access.redhat.com/errata/RHSA-2026:37272"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:37271 vom 2026-07-09",
"url": "https://access.redhat.com/errata/RHSA-2026:37271"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:37267 vom 2026-07-09",
"url": "https://access.redhat.com/errata/RHSA-2026:37267"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:34794 vom 2026-07-14",
"url": "https://access.redhat.com/errata/RHSA-2026:34794"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40118 vom 2026-07-15",
"url": "https://access.redhat.com/errata/RHSA-2026:40118"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40262 vom 2026-07-16",
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40945 vom 2026-07-16",
"url": "https://access.redhat.com/errata/RHSA-2026:40945"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:42146 vom 2026-07-20",
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40768 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:40768"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:42852 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:43052 vom 2026-07-22",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:42796 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40792 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:40792"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44622 vom 2026-07-23",
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:47149 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:47149"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44263 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44263"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:47952 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44235 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:44235"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48771 vom 2026-07-30",
"url": "https://access.redhat.com/errata/RHSA-2026:48771"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:49767 vom 2026-08-03",
"url": "https://access.redhat.com/errata/RHSA-2026:49767"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48699 vom 2026-08-05",
"url": "https://access.redhat.com/errata/RHSA-2026:48699"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:50888 vom 2026-08-05",
"url": "https://access.redhat.com/errata/RHSA-2026:50888"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:50874 vom 2026-08-05",
"url": "https://access.redhat.com/errata/RHSA-2026:50874"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:50843 vom 2026-08-05",
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:47728 vom 2026-08-06",
"url": "https://access.redhat.com/errata/RHSA-2026:47728"
}
],
"source_lang": "en-US",
"title": "Prometheus: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-08-05T22:00:00.000+00:00",
"generator": {
"date": "2026-08-06T11:51:17.711+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1292",
"initial_release_date": "2026-04-27T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-04-27T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-05-04T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2026-27091, EUVD-2026-27089"
},
{
"date": "2026-05-05T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2026-05-11T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2026-05-26T22:00:00.000+00:00",
"number": "5",
"summary": "CVE-2026-44903 erg\u00e4nzt"
},
{
"date": "2026-06-04T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-06-28T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-01T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-07T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-07-08T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-09T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-13T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-15T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-20T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-21T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-23T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-28T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-29T22:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-30T22:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-03T22:00:00.000+00:00",
"number": "20",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-04T22:00:00.000+00:00",
"number": "21",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-05T22:00:00.000+00:00",
"number": "22",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "22"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "azl3",
"product": {
"name": "Microsoft Azure Linux azl3",
"product_id": "T049210",
"product_identification_helper": {
"cpe": "cpe:/o:microsoft:azure_linux:azl3"
}
}
}
],
"category": "product_name",
"name": "Azure Linux"
}
],
"category": "vendor",
"name": "Microsoft"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c3.5.3",
"product": {
"name": "Open Source Prometheus \u003c3.5.3",
"product_id": "T053365"
}
},
{
"category": "product_version",
"name": "3.5.3",
"product": {
"name": "Open Source Prometheus 3.5.3",
"product_id": "T053365-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:prometheus:prometheus:3.5.3"
}
}
},
{
"category": "product_version_range",
"name": "\u003c3.11.3",
"product": {
"name": "Open Source Prometheus \u003c3.11.3",
"product_id": "T053366"
}
},
{
"category": "product_version",
"name": "3.11.3",
"product": {
"name": "Open Source Prometheus 3.11.3",
"product_id": "T053366-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:prometheus:prometheus:3.11.3"
}
}
},
{
"category": "product_version_range",
"name": "\u003e=2.49.0",
"product": {
"name": "Open Source Prometheus \u003e=2.49.0",
"product_id": "T053367"
}
},
{
"category": "product_version_range",
"name": "\u003e=2.49.0",
"product": {
"name": "Open Source Prometheus \u003e=2.49.0",
"product_id": "T053367-fixed"
}
}
],
"category": "product_name",
"name": "Prometheus"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"branches": [
{
"category": "product_version",
"name": "Container Platform",
"product": {
"name": "Red Hat OpenShift Container Platform",
"product_id": "T040130",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:container_platform"
}
}
},
{
"category": "product_version_range",
"name": "Container Platform \u003c4.22.4",
"product": {
"name": "Red Hat OpenShift Container Platform \u003c4.22.4",
"product_id": "T056451"
}
},
{
"category": "product_version",
"name": "Container Platform 4.22.4",
"product": {
"name": "Red Hat OpenShift Container Platform 4.22.4",
"product_id": "T056451-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:container_platform__4.22.4"
}
}
}
],
"category": "product_name",
"name": "OpenShift"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
},
{
"category": "product_name",
"name": "SUSE openSUSE",
"product": {
"name": "SUSE openSUSE",
"product_id": "T027843",
"product_identification_helper": {
"cpe": "cpe:/o:suse:opensuse:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42151",
"product_status": {
"known_affected": [
"T040130",
"T002207",
"67646",
"T027843",
"T049210",
"T056451",
"T032255",
"T053365",
"T053366"
]
},
"release_date": "2026-04-27T22:00:00.000+00:00",
"title": "CVE-2026-42151"
},
{
"cve": "CVE-2026-42154",
"product_status": {
"known_affected": [
"T040130",
"T002207",
"67646",
"T027843",
"T049210",
"T056451",
"T053367",
"T032255",
"T053365",
"T053366"
]
},
"release_date": "2026-04-27T22:00:00.000+00:00",
"title": "CVE-2026-42154"
},
{
"cve": "CVE-2026-44903",
"product_status": {
"known_affected": [
"T040130",
"T002207",
"67646",
"T027843",
"T049210",
"T056451",
"T032255",
"T053365",
"T053366"
]
},
"release_date": "2026-04-27T22:00:00.000+00:00",
"title": "CVE-2026-44903"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…