{"id":"CVE-2025-61140","aliases":["CLSA-2026-1789672446","EUVD-2025-206486","GHSA-6c59-mwgh-r2x6","ROOT-APP-NPM-CVE-2025-61140","SUSE-SU-2026:1008-1","SUSE-SU-2026:1013-1","SUSE-SU-2026:1035-1","SUSE-SU-2026:1148-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:20574-1","openSUSE-SU-2026:20239-1"],"status":"published","title":"JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00526,"percentile":0.45085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-502"],"published":"2026-01-28T00:00:00Z","modified":"2026-10-30T19:46:02Z","fixes":[{"ecosystem":"npm","package":"jsonpath","fixed_in":["1.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"jsonpath","fixed_in":["1.2.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jsonpath","fixed_in":["1.2.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jsonpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1-tuxcare.0"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"jsonpath","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jsonpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jsonpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150000.3.67.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-150000.1.90.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-159000.12.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-159000.4.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"Multi-Linux-ManagerTools-Beta-SLE-Micro-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-159000.3.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-150002.4.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-150002.3.9.3"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.2.1"}]}],"bundled":3}],"products":[{"vendor":"dchester","product":"jsonpath"},{"vendor":"red hat","product":"migration toolkit for virtualization"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.1"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"self-service automation portal 2.0"}],"references":[{"url":"https://github.com/dchester/jsonpath","tags":["Product","package"]},{"url":"https://gist.github.com/Dremig/8105c189774217222a8ebea3ed4d341d","tags":["Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61140","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433946","tags":["issue-tracking","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61140.json","tags":["x_sadp-csaf-vex","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2181","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3962","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3960","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2180","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61140","tags":["advisory"]},{"url":"https://github.com/dchester/jsonpath/issues/181","tags":["web"]},{"url":"https://github.com/dchester/jsonpath/issues/194","tags":["web"]},{"url":"https://github.com/dchester/jsonpath/pull/195","tags":["web"]},{"url":"https://github.com/dchester/jsonpath/commit/9631412641b7095f86840a7a45b5b3afc68b0fcb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6c59-mwgh-r2x6"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261008-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255588","tags":["report"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261013-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1251995","tags":["report"]},{"url":"https://bugzilla.suse.com/1253004","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1253347","tags":["report"]},{"url":"https://bugzilla.suse.com/1253659","tags":["report"]},{"url":"https://bugzilla.suse.com/1253738","tags":["report"]},{"url":"https://bugzilla.suse.com/1254589","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1255781","tags":["report"]},{"url":"https://bugzilla.suse.com/1256803","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261035-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213308","tags":["report"]},{"url":"https://bugzilla.suse.com/1214568","tags":["report"]},{"url":"https://bugzilla.suse.com/1214569","tags":["report"]},{"url":"https://bugzilla.suse.com/1216711","tags":["report"]},{"url":"https://bugzilla.suse.com/1217755","tags":["report"]},{"url":"https://bugzilla.suse.com/1220899","tags":["report"]},{"url":"https://bugzilla.suse.com/1221950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223368","tags":["report"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1228577","tags":["report"]},{"url":"https://bugzilla.suse.com/1230876","tags":["report"]},{"url":"https://bugzilla.suse.com/1232125","tags":["report"]},{"url":"https://bugzilla.suse.com/1233496","tags":["report"]},{"url":"https://bugzilla.suse.com/1236066","tags":["report"]},{"url":"https://bugzilla.suse.com/1236799","tags":["report"]},{"url":"https://bugzilla.suse.com/1237536","tags":["report"]},{"url":"https://bugzilla.suse.com/1238481","tags":["report"]},{"url":"https://bugzilla.suse.com/1239636","tags":["report"]},{"url":"https://bugzilla.suse.com/1240565","tags":["report"]},{"url":"https://bugzilla.suse.com/1241013","tags":["report"]},{"url":"https://bugzilla.suse.com/1243241","tags":["report"]},{"url":"https://bugzilla.suse.com/1243679","tags":["report"]},{"url":"https://bugzilla.suse.com/1243768","tags":["report"]},{"url":"https://bugzilla.suse.com/1243808","tags":["report"]},{"url":"https://bugzilla.suse.com/1243876","tags":["report"]},{"url":"https://bugzilla.suse.com/1243881","tags":["report"]},{"url":"https://bugzilla.suse.com/1244177","tags":["report"]},{"url":"https://bugzilla.suse.com/1244542","tags":["report"]},{"url":"https://bugzilla.suse.com/1244648","tags":["report"]},{"url":"https://bugzilla.suse.com/1244724","tags":["report"]},{"url":"https://bugzilla.suse.com/1245241","tags":["report"]},{"url":"https://bugzilla.suse.com/1245307","tags":["report"]},{"url":"https://bugzilla.suse.com/1245405","tags":["report"]},{"url":"https://bugzilla.suse.com/1245766","tags":["report"]},{"url":"https://bugzilla.suse.com/1246421","tags":["report"]},{"url":"https://bugzilla.suse.com/1246981","tags":["report"]},{"url":"https://bugzilla.suse.com/1247038","tags":["report"]},{"url":"https://bugzilla.suse.com/1248741","tags":["report"]},{"url":"https://bugzilla.suse.com/1248804","tags":["report"]},{"url":"https://bugzilla.suse.com/1249502","tags":["report"]},{"url":"https://bugzilla.suse.com/1251864","tags":["report"]},{"url":"https://bugzilla.suse.com/1252937","tags":["report"]},{"url":"https://bugzilla.suse.com/1253024","tags":["report"]},{"url":"https://bugzilla.suse.com/1253068","tags":["report"]},{"url":"https://bugzilla.suse.com/1253158","tags":["report"]},{"url":"https://bugzilla.suse.com/1253322","tags":["report"]},{"url":"https://bugzilla.suse.com/1253501","tags":["report"]},{"url":"https://bugzilla.suse.com/1253773","tags":["report"]},{"url":"https://bugzilla.suse.com/1255298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254256","tags":["report"]},{"url":"https://bugzilla.suse.com/1254257","tags":["report"]},{"url":"https://bugzilla.suse.com/1254903","tags":["report"]},{"url":"https://bugzilla.suse.com/1254904","tags":["report"]},{"url":"https://bugzilla.suse.com/1254905","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258957","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67726","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620574-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61140","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-09-07T12:05:08.824Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1321","CWE-502"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-206486","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-09-07T12:05:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-6c59-mwgh-r2x6","title":"JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","status":"published","published":"2026-01-28T18:30:47Z","modified":"2026-02-05T16:14:31Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:23.728882Z"}],"nvd":[{"id":"CVE-2025-61140","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","status":"published","published":"2026-01-28T16:16:13.547Z","modified":"2026-09-07T13:17:29.797Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321","CWE-502"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"GHSA-6c59-mwgh-r2x6","title":"JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js","description":"The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.","status":"published","published":"2026-01-28T18:30:47Z","modified":"2026-02-05T16:30:42.225658Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"CLSA-2026-1789672446","title":"TuxCare security update for jsonpath (2 CVEs)","description":"TuxCare rebuilt jsonpath to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.","status":"published","published":"2026-09-17T19:14:06Z","modified":"2026-10-30T19:46:02.792417983Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"openSUSE-SU-2026:20239-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\n- CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)\n- CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)\n- CVE-2025-61140:  Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)\n","status":"published","published":"2026-02-17T09:54:15Z","modified":"2026-03-23T04:54:48.446847Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-APP-NPM-CVE-2025-61140","title":"CVE-2025-61140 in jsonpath - Patched by Root","description":"Root has patched CVE-2025-61140 in the jsonpath package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-18T12:23:41Z","modified":"2026-09-18T13:15:02.938136425Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2026:1008-1","title":"Security update for Prometheus ","description":"This update for Prometheus fixes the following issues:\n\ngolang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter: \n\n- Internal changes to fix build issues with no impact for customers   \n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations.\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times.\n","status":"published","published":"2026-03-25T10:07:27Z","modified":"2026-03-26T09:00:27.331237Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1013-1","title":"Security update 5.0.7 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to 3 times (bsc#1253004)\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization and update\n\ngolang-github-boynux-squid_exporter:\n\n- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):\n\n  * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path\n  * Added TLS and Basic Authentication to the exporter’s web interface\n  * Added support for the exporter to authenticate against the Squid proxy itself\n  * Allow the gathering of process information without requiring root privileges\n  * The exporter can now be configured using environment variables\n  * Added support for custom labels to all exported metrics for better data filtering\n  * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred\n  * Added 'service time' metrics to analyze proxy speed and performance.\n  * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks\n  * Corrected the squid_client_http_requests_total metric to ensure accurate reporting\n\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Version update from 1.0.8 to 1.0.10:\n\n  * Updated github.com/prometheus/client_golang to 1.21.1\n  * Updated github.com/prometheus/common to 0.63.0\n  * Updated github.com/prometheus/exporter-toolkit to 0.14.0\n  * Fixed signal handler logging\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times\n\ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n  * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:\n \n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version update to 5.0.15:\n\n  * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to integer values (bsc#1251995)\n  * Fixed spacecmd binary file upload (bsc#1253659)\n\nuyuni-tools:\n\n- Version update to 0.1.38:\n\n  * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Ignore supportconfig errors (bsc#1255781)\n  * Bumped the default image tag to 5.0.7\n  * Removed cgroup mount for podman containers (bsc#1253347)\n  * Registry flag can be a string (bsc#1254589)\n  * Use static supportconfig name to avoid dynamic search (bsc#1257941)\n\n","status":"published","published":"2026-03-25T10:11:52Z","modified":"2026-03-26T09:00:33.541819Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1035-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-03-25T10:21:15Z","modified":"2026-07-13T14:00:32.648174458Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1148-1","title":"Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus:\n\n- CVE-2026-27606: Fix arbitrary file write via path traversal in\n  rollup (bsc#1258893)\n  * Bump rollup to version 4.59.0\n- Drop SLE 12 support (jsc#PED-15474)\n- CVE-2026-25547: Fix unbounded brace range expansion leading to\n  excessive CPU and memory consumption (bsc#1257841):\n  * Bump brace-expansion to version 5.0.2\n- Do not build old web UI. Fixes following security\n  vulnerabilities:\n  * CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe\n    evaluation of user-supplied JSON Path expressions (bsc#1257897)\n  * CVE-2025-61140: jsonpath: the `value` function is vulnerable to\n    prototype pollution (bsc#1257442)\n- Set source URL in the spec file and drop tar service\n\ngrafana:\n\n- Drop support for SLE 12 (jsc#PED-15474)\n- Update to version 11.6.11:\n  Features and enhancements:\n  * Alerting: Add limits for the size of expanded notification\n    templates\n  * Correlations: Remove support for org_id=0\n  Security:\n  * CVE-2026-21722: Public dashboards annotations: use dashboard\n    timerange if time selection disabled (bsc#1258136)\n- Update to version 11.6.10:\n  * API: Add missing scope check on dashboards\n  * Avatar: Require sign-in, remove queue, respect timeout\n  Bug fixes:\n  * Alerting: Fix a race condition panic in ResetStateByRuleUID\n- Update to version 11.6.9:\n  * Plugins: Add PluginContext to plugins when scenes is disabled\n  * Alerting: Fix contacts point issues\n- Update to version 11.6.8:\n  * Alerting: Fix unmarshalling of GettableStatus to include time\n    intervals\n- Update to version 11.6.7:\n  * Auth: Fix render user OAuth passthrough\n  * LDAP Authentication: Fix URL to propagate username context as\n    parameter\n  * Plugins: Dependencies do not inherit parent URL for preinstall\n  * URLParams: Stringify true values as key=true always (fixes\n    issues with variables with true value)\n- Update to version 11.6.6:\n  * Alerting: Fix copying of recording rule fields\n  * Fix redirection after login when Grafana is served from subpath\n- Update to version 11.6.5:\n  * Alerting: Bump alerting package to include change to\n    NewTLSClient\n- Update to version 11.6.4:\n  * StateTimeline: Add endTime to tooltip\n  * Unified storage: Respect GF_DATABASE_URL override\n  * Alerting: Fix group interval override when adding new rules\n  * Azure: Fix legend formatting\n  * Azure: Fix resource name determination in template variable\n    queries\n  * Graphite: Fix annotation queries\n  * Graphite: Fix date mutation\n  * Graphite: Fix nested variable interpolation for repeated rows\n- Update to version 11.6.3:\n  * Fixes CVE-2025-3415\n- Update to version 11.6.2:\n  * Dashboard: Fixes issue with row repeats and first row\n  * Graphite: Ensure template variables are interpolated correctly\n  * Graphite: Fix Graphite series interpolation\n  * Prometheus: Fix semver import path\n- Update to version 11.6.1:\n  * DashboardScenePage: Correct slug in self referencing data links\n  * GrafanaUI: Use safePolygon close handler for interactive\n    tooltips instead of a delay\n  * Prometheus: Add support for cloud partners Prometheus data\n    sources\n  * Alertmanager: Add Role-Based Access Control via reqAction Field\n  * GrafanaUI: Remove blurred background from overlay backdrops to\n    improve performance\n  * InfluxDB: Fix nested variable interpolation\n  * LDAP test: Fix page crash\n  * Org redirection: Fix linking between orgs\n- Upgrade to version 11.6.0:\n  * Visualisations: One click links and actions\n  * Annotations: Add cron syntax support\n  * WebGL-powered geomaps for better performance\n  * Alerting: Add alert rule version history\n  * API keys: Migrate API keys to service accounts at startup\n\nmgr-push:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nrhnlib:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nspacecmd:\n\n- Version 5.2.6-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nuyuni-common-libs:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nuyuni-tools:\n\n- Version 5.2.5-0\n  * Remove migrate command\n  * Remove template script from mgradm: use the one in the image\n  * Split the TFTP server into a separate container\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Adjust mgrctl server filter to work with the new helm chart\n    labels\n  * Remove hub register command\n  * Remove the Kubernetes install and upgrade from mgrpxy\n  * Optimize postgres migration disk space usage (bsc#1257447)\n\nvenv-salt-minion:\n\n- Fix the issue preventing SELinux profile to be loaded on SLES 16\n  deployed using cloud images (bsc#1258957)\n- Fix the typo causing buiding EL9 bundle without binary dependencies\n- Backport security patches for Salt vendored tornado:\n  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)\n  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)\n  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)\n- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)\n- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)\n    \nMulti-Linux-ManagerTools-Beta-SLE-Micro-release:\n  - Make the product installable on all SLE Micro 5 family","status":"published","published":"2026-03-30T11:21:20Z","modified":"2026-03-31T08:00:12.592036Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n    \ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n    + Bumped rollup to version 4.59.0\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n    + Bumped brace-expansion to version 5.0.2\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    + Bumped google.golang.org/grpc to version 1.79.3\n    \n    \ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n  * CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  * CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:\n    \n  * Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability\n  * Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences\n  * Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: \n    + Fixed bugs involving row repeats and 'self-referencing' data links\n    + Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n\nspacecmd:\n\n- Version 5.1.13-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 5.1.26-0\n  * Fixed applying PTF with images from RPMs (bsc#1252548)\n  * Ssl Key file can miss if CA password is blank (bsc#1254154)\n  * mgrpxy ssh tuning should happens before crypto policies (bsc#1254619)\n  * Fixed default value for helm registry (bsc#1258927).\n  * Remove hub register command\n  * Optimize postgres migration disk space usage (bsc#1257447)\n  * Added continuous database backup support (bsc#1250367)\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  * Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  * Show where final tarball was generated (bsc#1259208)\n  * Set proxy config file permissions (bsc#1257660)\n- Version 5.1.25-0\n  * If PTF image doesn't exists, use the current service image (bsc#1258418)\n\n","status":"published","published":"2026-04-21T09:26:09Z","modified":"2026-04-22T08:15:49.030922Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20574-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\n- CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)\n- CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)\n- CVE-2025-61140:  Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)\n","status":"withdrawn","published":"2026-02-17T09:51:55Z","modified":"2026-05-05T08:00:40.195341Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}