Security
فارسی
All products

github.com/prometheus/prometheus

Go · Package
6 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorerCVE-2026-40179 · GHSA-VFFH-X6R8-XX99Version ranges need review. github.com/prometheus/prometheus Go Medium Fix reported
Prometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151 · GHSA-WG65-39GG-5WFJVersion ranges need review. github.com/prometheus/prometheusFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle GoRed Hat High Fix reported
Prometheus: Remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154 · GHSA-8RM2-7QQF-34QMVersion ranges need review. github.com/prometheus/prometheus/v2github.com/prometheus/prometheus GoRed Hat High Fix reported
Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap displayCVE-2026-44903 · GHSA-FW8G-CG8F-9J28Version ranges need review. github.com/prometheus/prometheus Go Medium Fix reported
Prometheus vulnerable to basic authentication bypassGHSA-4V48-4Q5M-8VX4 github.com/prometheus/prometheus/v2github.com/prometheus/prometheus Go High Fix reported
Arbitrary redirects under /new endpointCVE-2021-29622 · GHSA-VX57-7F4Q-FPC7 github.com/prometheus/prometheus Go Medium Fix reported