Skip to content
OpenAdvisories

Package · Debian

prometheus

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.1
    CVE-2026-44903

    Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

    Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not es…

    prometheus prometheus prometheus github.com/prometheus/prometheus Debian Ubuntu Go
  • High 7.5
    CVE-2026-42154 Public exploit

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

    prometheus prometheus prometheus prometheus Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2026-42151

    Prometheus Azure AD remote write OAuth client secret exposed via config API

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus re…

    prometheus prometheus prometheus github.com/prometheus/prometheus Debian Ubuntu Alpine Go
  • Medium 6.1
    CVE-2019-3826

    A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could ex…

    [UNKNOWN] prometheus prometheus prometheus Debian Ubuntu