prometheus records

11 published records for vendor prometheus.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 81.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

11 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2022-46146No exploit	Prometheus Exporter Toolkit vulnerable to basic authentication bypassprometheus · exporter toolkit · CWE-287 Auth bypass	High8.8	—	1.3%	Nov 29, 2022
32Monitor	CVE-2022-21698No exploit	Uncontrolled Resource Consumption in promhttpprometheus · client golang · CWE-400 Pre-auth Denial of service	High7.5	—	6.0%	Feb 15, 2022
30Monitor	CVE-2021-29622Proof of concept	Arbitrary redirects under /new endpointprometheus · prometheus · CWE-601 Pre-auth Open redirect	Medium6.1	—	19.6%	May 19, 2021
30Monitor	CVE-2026-42154Proof of concept	Prometheus: remote read endpoint allows denial of service via crafted snappy payloadprometheus · prometheus · CWE-400 Pre-auth Denial of service	High7.5	—	0.9%	May 4, 2026
30Monitor	CVE-2023-26735No exploit	blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface.prometheus · blackbox exporter · CWE-918 Pre-auth SSRF	High7.5	—	0.9%	Apr 25, 2023
30Monitor	CVE-2026-42151No exploit	Prometheus Azure AD remote write OAuth client secret exposed via config APIprometheus · prometheus · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	May 4, 2026
25Monitor	CVE-2019-3826No exploit	A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.prometheus · prometheus · CWE-79 Pre-auth XSS	Medium6.1	—	2.6%	Mar 26, 2019
24Monitor	CVE-2020-16248Proof of concept	Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF.prometheus · blackbox exporter · CWE-918 Pre-auth SSRF	Medium5.8	—	2.7%	Aug 9, 2020
21Monitor	CVE-2023-40577No exploit	Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointprometheus · alertmanager · CWE-79 RCE XSS	Medium5.4	—	0.6%	Aug 24, 2023
21Monitor	CVE-2026-40179Proof of concept	Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerprometheus · prometheus · CWE-79 Pre-auth XSS	Medium5.3	—	0.3%	Apr 15, 2026
20Monitor	CVE-2026-44903No exploit	Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UIprometheus · prometheus · CWE-79 XSS	Medium5.1	—	0.2%	May 26, 2026

CVE-2022-46146
35Monitor
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
prometheus · exporter toolkitNov 29, 2022
CVE-2022-21698
32Monitor
Uncontrolled Resource Consumption in promhttp
HighCVSS 7.5No exploitEPSS 6%
- Pre-auth
- Denial of service
prometheus · client golangFeb 15, 2022
CVE-2021-29622
30Monitor
Arbitrary redirects under /new endpoint
MediumCVSS 6.1Proof of conceptEPSS 20%
- Pre-auth
- Open redirect
prometheus · prometheusMay 19, 2021
CVE-2026-42154
30Monitor
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Denial of service
prometheus · prometheusMay 4, 2026
CVE-2023-26735
30Monitor
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- SSRF
prometheus · blackbox exporterApr 25, 2023
CVE-2026-42151
30Monitor
Prometheus Azure AD remote write OAuth client secret exposed via config API
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
prometheus · prometheusMay 4, 2026
CVE-2019-3826
25Monitor
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.
MediumCVSS 6.1No exploitEPSS 3%
- Pre-auth
- XSS
prometheus · prometheusMar 26, 2019
CVE-2020-16248
24Monitor
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF.
MediumCVSS 5.8Proof of conceptEPSS 3%
- Pre-auth
- SSRF
prometheus · blackbox exporterAug 9, 2020
CVE-2023-40577
21Monitor
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
MediumCVSS 5.4No exploitEPSS 1%
- RCE
- XSS
prometheus · alertmanagerAug 24, 2023
CVE-2026-40179
21Monitor
Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
prometheus · prometheusApr 15, 2026
CVE-2026-44903
20Monitor
Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
MediumCVSS 5.1No exploitEPSS 0%
- XSS
prometheus · prometheusMay 26, 2026