Log in Start free

prometheus

Products

ProductCVEsExploitedLatest
prometheus6–Oct 30, 2026
alertmanager1–Aug 25, 2023
client_golang1–Feb 15, 2022
exporter-toolkit1–Nov 29, 2022

Exploited and recent CVEs

  • CVE-2026-119566 Medium 4.8 Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects 0.2%
  • CVE-2026-44903 Medium 5.1 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI 0.2%
  • CVE-2026-42154 High 7.5 Prometheus: remote read endpoint allows denial of service via crafted snappy payload 0.8%
  • CVE-2026-42151 High 7.5 Prometheus Azure AD remote write OAuth client secret exposed via config API 0.4%
  • CVE-2026-40179 Medium 5.3 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer 0.3%
  • CVE-2023-40577 High 7.5 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint 0.6%
  • CVE-2022-46146 Medium 6.2 Prometheus Exporter Toolkit vulnerable to basic authentication bypass 1.3%
  • CVE-2022-21698 High 7.5 Uncontrolled Resource Consumption in promhttp 6.0%
  • CVE-2021-29622 Medium 6.5 Arbitrary redirects under /new endpoint 19.6%