Priority LOW 27
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00201 · Published 2026-10-30 · No fix listed CWE-522
Priority LOW 23
Prometheus is an open-source monitoring system and time series database.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00204 · Published 2026-05-26 · Fixed in 3.5.3, 3.11.3 +1 CWE-79
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00813 · Published 2026-05-04 · Partial fix · 3.5.3, 3.11.3 +2 CWE-400
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00352 · Published 2026-05-04 · Partial fix · 3.5.3, 3.11.3 +1 CWE-200
Priority LOW 24
Prometheus is an open-source monitoring system and time series database.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0031 · Published 2026-04-15 · Fixed in 3.5.2, 3.11.2 +1 CWE-79
Priority MEDIUM 40
Alertmanager handles alerts sent by client applications such as the Prometheus server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00634 · Published 2023-08-25 · Fixed in 0.25.1 CWE-79
Priority HIGH 72
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0089 · Published 2023-04-25 · No fix listed CWE-918
Priority MEDIUM 41
Prometheus Exporter Toolkit is a utility package to build exporters.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01289 · Published 2022-11-29 · Partial fix · 0.7.2, 0.8.2 CWE-287
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05994 · Published 2022-02-15 · Partial fix · 1.11.1 CWE-400
Priority MEDIUM 47
Prometheus is an open-source monitoring system and time series database.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.1956 · Published 2021-05-19 · Fixed in 2.27.1 CWE-601
Priority LOW 32
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.03106 · Published 2020-08-09 · No fix listed CWE-918
Priority LOW 32
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02497 · Published 2019-03-26 · Partial fix CWE-79
THREATIST.IORead the docs