TI-2023-11754 CVE-2023-26735
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe…
Priority HIGH 72
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface.
prometheus
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
prometheus records in CISA KEVNo prometheus vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p
Uncontrolled Resource Consumption in promhttp
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
TI-2021-10330 CVE-2021-29622
Arbitrary redirects under /new endpoint
Priority MEDIUM 47
Prometheus is an open-source monitoring system and time series database.
TI-2022-22790 CVE-2022-46146 · GHSA-7rg2-cxvp-9p7p
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Priority MEDIUM 41
Prometheus Exporter Toolkit is a utility package to build exporters.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2023-21376 CVE-2023-40577 · GHSA-v86x-5fm3-5p7j
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Priority MEDIUM 40
Alertmanager handles alerts sent by client applications such as the Prometheus server.
TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
TI-2020-12777 CVE-2020-16248 · GHSA-8jrj-57gq-475g
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF.
Priority LOW 32
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF.
Priority LOW 32
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.
TI-2026-83030 CVE-2026-119566 · GHSA-597x-6fqq-75wr
Credential leak in Prometheus remote_write via cross-host redirects
Priority LOW 27
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host.
TI-2026-28993 CVE-2026-40179 · GHSA-vffh-x6r8-xx99
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
Priority LOW 24
Prometheus is an open-source monitoring system and time series database.
TI-2026-32778 CVE-2026-44903 · GHSA-fw8g-cg8f-9j28
Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
Priority LOW 23
Prometheus is an open-source monitoring system and time series database.