Skip to content
OpenAdvisories

Package · Wolfi

prometheus-3.9

67 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-56852 Public exploit

    Infinite loop on invalid input in golang.org/x/text

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

    golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby docker/daemon Docker Engine Debian Ubuntu Alpine Wolfi Go
  • Critical 10.0
    CVE-2026-46595 Public exploit

    Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

    Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

    golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-42154 Public exploit

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

    prometheus prometheus k8sgpt minio Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-40179 Public exploit

    Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

    Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values a…

    prometheus prometheus minio splunk-otel-collector Ubuntu Alpine Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go