Prometheus vulnerabilities
3 known vulnerabilities affecting prometheus/prometheus.
Total CVEs
3
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
MEDIUM3
Vulnerabilities
Page 1 of 1
CVE-2026-40179MEDIUMCVSS 5.3v>= 3.0.0, < 3.5.2v>= 3.6.0, < 3.11.2+1 more2026-04-15
CVE-2026-40179 [MEDIUM] CWE-79 CVE-2026-40179: Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1
Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart to
cvelistv5nvd
CVE-2021-29622MEDIUMCVSS 6.1PoC≥ 2.23.0, < 2.26.1v2.27.0+1 more2021-05-19
CVE-2021-29622 [MEDIUM] CWE-601 CVE-2021-29622: Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus chang
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user vi
cvelistv5nvd
CVE-2019-3826MEDIUMCVSS 6.1fixed in 2.7.12019-03-26
CVE-2019-3826 [MEDIUM] CWE-79 CVE-2019-3826: A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. A
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
nvdosv