prometheus vulnerabilities
9 published CVEs name prometheus among the affected products.
- 9Published CVEs9 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119566
Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
prometheus · prometheus
Medium6.3 - CVE-2026-44903
Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
prometheus · prometheus
Medium5.1 - CVE-2026-42154
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
prometheus · prometheus
High7.5 - CVE-2026-42151
Prometheus Azure AD remote write OAuth client secret exposed via config API
prometheus · prometheus
High7.5 - CVE-2026-40179
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
prometheus · prometheus
Medium5.3 - CVE-2023-40577
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
prometheus · alertmanager
High7.5 - CVE-2022-46146
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
prometheus · exporter-toolkit
Medium6.2 - CVE-2022-21698
Uncontrolled Resource Consumption in promhttp
prometheus · client_golang
High7.5 - CVE-2021-29622
Arbitrary redirects under /new endpoint
prometheus · prometheus
Medium6.5