Skip to content
OpenAdvisories

Package · Ubuntu

prometheus

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-44903

    Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

    Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not es…

    prometheus prometheus prometheus github.com/prometheus/prometheus Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-40179 Public exploit

    Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

    Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values a…

    prometheus prometheus prometheus github.com/prometheus/prometheus Ubuntu Alpine Go
  • Medium 6.2
    CVE-2022-46146

    Prometheus Exporter Toolkit vulnerable to basic authentication bypass

    Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. …

    prometheus exporter-toolkit prometheus prometheus Debian Ubuntu Alpine Go
  • Medium 6.5
    CVE-2021-29622 EPSS 20%

    Arbitrary redirects under /new endpoint

    Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an att…

    prometheus prometheus prometheus prometheus Ubuntu Alpine
  • Medium 6.1
    CVE-2019-3826

    A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could ex…

    [UNKNOWN] prometheus prometheus prometheus Debian Ubuntu