Vulnerabilities

TI-2026-32778 CVE-2026-44903 · GHSA-fw8g-cg8f-9j28

Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

LOW 23

Prometheus is an open-source monitoring system and time series database.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00204 Published 2026-05-26 Fixed in 3.5.3, 3.11.3 +1 CWE-79

TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm

MEDIUM 40

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00813 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +2 CWE-400

TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj

LOW 39

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +1 CWE-200

TI-2026-28993 CVE-2026-40179 · GHSA-vffh-x6r8-xx99

LOW 24

Prometheus is an open-source monitoring system and time series database.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0031 Published 2026-04-15 Fixed in 3.5.2, 3.11.2 +1 CWE-79

TI-2021-10330 CVE-2021-29622

MEDIUM 47

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.1956 Published 2021-05-19 Fixed in 2.27.1 CWE-601

TI-2019-02838 CVE-2019-3826

LOW 32

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02497 Published 2019-03-26 Partial fix CWE-79