golang-github-prometheus-prometheus vulnerabilities (SUSE)
187 vulnerabilities.
-
golang-github-prometheus-prometheusSUSE Session takeover via Auth Proxy cache key collision 7.1 High -
golang-github-prometheus-prometheusSUSE SQL Data Source Plugin: OOM DoS via $__timeGroup macro 6.5 Medium -
golang-github-prometheus-prometheusSUSE Broken access control in dashboard snapshots 6.3 Medium -
golang-github-prometheus-prometheusSUSE CVE-2026-17033 CVE Record 6.8 Medium -
golang-github-prometheus-prometheusSUSE CVE-2026-17183 CVE Record 7.1 High -
golang-github-prometheus-prometheusSUSE pip absolute path traversal during download from malicious package indexes 5.6 Medium -
golang-github-prometheus-prometheusSUSE kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
golang-github-prometheus-prometheusSUSE CVE-2026-21723 Record 5.3 Medium -
golang-github-prometheus-prometheusSUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
golang-github-prometheus-prometheusSUSE Stored XSS in the table panel (TableNG) 6.8 Medium -
golang-github-prometheus-prometheusSUSE Pre-authentication denial of service via the OAuth login route 5.3 Medium -
golang-github-prometheus-prometheusSUSE Denial of service via unbounded request body size 7.5 High -
golang-github-prometheus-prometheusSUSE Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 8.7 High -
golang-github-prometheus-prometheusSUSE Tarfile.extract() doesn't fully respect filter parameter 2.0 Low -
golang-github-prometheus-prometheusSUSE brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 7.7 High -
golang-github-prometheus-prometheusSUSE lxml: javascript: URL bypass in Cleaner via xlink:href 8.2 High -
golang-github-prometheus-prometheusSUSE tarfile opened in streaming mode mishandles EOF 8.2 High -
golang-github-prometheus-prometheusSUSE Configuration Injection via Carriage Return (\r) in write() method 4.1 Medium -
golang-github-prometheus-prometheusSUSE tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
golang-github-prometheus-prometheusSUSE Pre-authentication denial of service in the public dashboard query endpoint 7.5 High -
golang-github-prometheus-prometheusSUSE Stored XSS in the Geomap panel tile-layer attribution 7.3 High -
golang-github-prometheus-prometheusSUSE tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 7.5 High -
golang-github-prometheus-prometheusSUSE Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 7.7 High -
golang-github-prometheus-prometheusSUSE sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 5.4 Medium -
golang-github-prometheus-prometheusSUSE Tornado: Out-of-bounds memory access in C extension 5.3 Medium -
golang-github-prometheus-prometheusSUSE tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
golang-github-prometheus-prometheusSUSE Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
golang-github-prometheus-prometheusSUSE React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
golang-github-prometheus-prometheusSUSE React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
golang-github-prometheus-prometheusSUSE React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
golang-github-prometheus-prometheusSUSE React Router has stored XSS via unescaped Location header in prerendered redirect HTML 5.4 Medium -
golang-github-prometheus-prometheusSUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
golang-github-prometheus-prometheusSUSE pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
golang-github-prometheus-prometheusSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
golang-github-prometheus-prometheusSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
golang-github-prometheus-prometheusSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
golang-github-prometheus-prometheusSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
golang-github-prometheus-prometheusSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
golang-github-prometheus-prometheusSUSE Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
golang-github-prometheus-prometheusSUSE Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 9.3 Critical -
golang-github-prometheus-prometheusSUSE FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 5.9 Medium -
golang-github-prometheus-prometheusSUSE IDOR in Annotations API allows unprivileged users to DELETE annotation 4.3 Medium -
golang-github-prometheus-prometheusSUSE Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 6.5 Medium -
golang-github-prometheus-prometheusSUSE Grafana plugin resources can lead to unbounded memory allocation 6.5 Medium -
golang-github-prometheus-prometheusSUSE Auth Proxy IPv6 whitelist bypass 7.4 High -
golang-github-prometheus-prometheusSUSE SQL Expressions Read File From Disk 6.3 Medium -
golang-github-prometheus-prometheusSUSE BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 6.5 Medium -
golang-github-prometheus-prometheusSUSE Users can generate Service Account tokens after permissions removal 5.9 Medium -
golang-github-prometheus-prometheusSUSE Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 7.1 High -
golang-github-prometheus-prometheusSUSE Grafana Live push endpoint allows unbounded memory allocation leading to OOM 6.5 Medium - Show olderLoading…