golang-github-prometheus-prometheus vulnerabilities (SUSE)
187 vulnerabilities.
golang-github-prometheus-prometheusSUSEViewer-triggered race condition in Grafana Live leads to complete server crash6.5 Mediumgolang-github-prometheus-prometheusSUSEThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection6.3 Mediumgolang-github-prometheus-prometheusSUSEurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highgolang-github-prometheus-prometheusSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 Highgolang-github-prometheus-prometheusSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highgolang-github-prometheus-prometheusSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highgolang-github-prometheus-prometheusSUSEApache Thrift: C++ JSON OOB read6.5 Mediumgolang-github-prometheus-prometheusSUSEApache Thrift: c_glib dispatch stack overflow5.3 Mediumgolang-github-prometheus-prometheusSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 Highgolang-github-prometheus-prometheusSUSESecurity update for python-pyOpenSSLNo scoregolang-github-prometheus-prometheusSUSEpip self-update functionality can import newly installed modules after wheel installation5.3 Mediumgolang-github-prometheus-prometheusSUSEBaseCookie.js_output() does not neutralize embedded characters2.1 Lowgolang-github-prometheus-prometheusSUSElxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 Highgolang-github-prometheus-prometheusSUSEpip doesn't reject concatenated ZIP and tar archives4.6 Mediumgolang-github-prometheus-prometheusSUSEGrafana Alerting Editors can edit destination of webhooks they did not create1.3 Lowgolang-github-prometheus-prometheusSUSEIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()7.0 Highgolang-github-prometheus-prometheusSUSEUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure9.1 Criticalgolang-github-prometheus-prometheusSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediumgolang-github-prometheus-prometheusSUSEBase64 decoding stops at first padded quad by default6.0 Mediumgolang-github-prometheus-prometheusSUSEHTTP client proxy tunnel headers not validated for CR/LF5.7 Mediumgolang-github-prometheus-prometheusSUSEOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies5.3 Mediumgolang-github-prometheus-prometheusSUSEGo JOSE affect by a panic in JWE decryption7.5 Highgolang-github-prometheus-prometheusSUSEQuery resampling can cause unbounded memory allocations6.5 Mediumgolang-github-prometheus-prometheusSUSEGrafana Testdata datasource can issue unbounded memory allocations6.5 Mediumgolang-github-prometheus-prometheusSUSERCE on Grafana via sqlExpressions9.1 Criticalgolang-github-prometheus-prometheusSUSEPublic dashboards discloses all direct mode datasources6.5 Mediumgolang-github-prometheus-prometheusSUSEMissing Protected-field Authorization in Provisioning Contact Points API5.4 Mediumgolang-github-prometheus-prometheusSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 Criticalgolang-github-prometheus-prometheusSUSEpkgutil.get_data() does not enforce documented restrictions0.0 Nonegolang-github-prometheus-prometheusSUSEpyOpenSSL DTLS cookie callback buffer overflow7.2 Highgolang-github-prometheus-prometheusSUSEAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 Lowgolang-github-prometheus-prometheusSUSERollup 4 has Arbitrary File Write via Path Traversal8.8 Highgolang-github-prometheus-prometheusSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 Lowgolang-github-prometheus-prometheusSUSEfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity1.7 Lowgolang-github-prometheus-prometheusSUSEPublic Dashboards time range restriction on annotations can be bypassed5.3 Mediumgolang-github-prometheus-prometheusSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 Mediumgolang-github-prometheus-prometheusSUSEjsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Criticalgolang-github-prometheus-prometheusSUSEUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticalgolang-github-prometheus-prometheusSUSELimited path traversal when installing wheel archives2.0 Lowgolang-github-prometheus-prometheusSUSEJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Criticalgolang-github-prometheus-prometheusSUSEDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 Highgolang-github-prometheus-prometheusSUSEUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 Highgolang-github-prometheus-prometheusSUSEPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 Mediumgolang-github-prometheus-prometheusSUSEReact Router has Path Traversal in File Session Storage9.1 Criticalgolang-github-prometheus-prometheusSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 Highgolang-github-prometheus-prometheusSUSETornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 Highgolang-github-prometheus-prometheusSUSETornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 Highgolang-github-prometheus-prometheusSUSETornado vulnerable to Header Injection and XSS via reason argument5.4 Mediumgolang-github-prometheus-prometheusSUSEExcessive read buffering DoS in http.client6.3 Mediumgolang-github-prometheus-prometheusSUSESalt Master authentication protocol downgrade may enable minion impersonation7.5 High- Show moreLoading…