PR
Vendor
prometheus
11
CVEs
0
On KEV
0
New 30D
Products
PR7.5
prometheus
prometheus
6 CVEs0 on KEV0 new
BE7.5
Blackbox Exporter
Prometheus
2 CVEs0 on KEV0 new
AL5.4
Alertmanager
Prometheus
1 CVEs0 on KEV0 new
CG7.5
Client Golang
Prometheus
1 CVEs0 on KEV0 new
ET8.8
Exporter Toolkit
Prometheus
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44903 | PR prometheus prometheus | 6.1 | May 26 | Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI |
| CVE-2026-42154 | PR prometheus prometheus | 7.5 | May 4 | Prometheus: remote read endpoint allows denial of service via crafted snappy payload |
| CVE-2026-42151 | PR prometheus prometheus | 7.5 | May 4 | Prometheus Azure AD remote write OAuth client secret exposed via config API |
| CVE-2026-40179 | PR prometheus prometheus | 6.1 | Apr 15 | Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer |
| CVE-2023-40577 | AL Alertmanager Prometheus | 5.4 | Aug 25 | Alertmanager handles alerts sent by client applications such as the Prometheus server |
| CVE-2023-26735 | BE Blackbox Exporter Prometheus | 7.5 | Apr 26 | blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface |
| CVE-2022-46146 | ET Exporter Toolkit Prometheus | 8.8 | Nov 29 | Prometheus Exporter Toolkit is a utility package to build exporters |
| CVE-2022-21698 | CG Client Golang Prometheus | 7.5 | Feb 15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients |
| CVE-2021-29622 | PR Prometheus Prometheus | 6.1 | May 19 | Prometheus is an open-source monitoring system and time series database |
| CVE-2020-16248 | BE Blackbox Exporter Prometheus | 5.8 | Aug 9 | Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF |
| CVE-2019-3826 | PR Prometheus Prometheus | 6.1 | Mar 26 | A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1 |