https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:28:34.272108+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-prometheus-2021-29622 BIT-prometheus-2021-29622 — Arbitrary redirects under /new endpoint 2026-10-02T23:28:34.455739+00:00

Affected: Bitnami: prometheus

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-jd89615 CLEANSTART-2026-JD89615 — Security fix for CVE-2021-29622 applied in: prometheus 2.27.1-r0, prometheus-fips 2.27.1-r0 2026-10-02T23:28:34.455803+00:00

Affected: CleanStart: prometheus, CleanStart: prometheus-fips

CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-26523 EUVD-2026-26523 2026-10-02T23:28:34.455858+00:00 EUVD-2026-26523 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29622 fkie_cve-2021-29622 2026-10-02T23:28:34.455873+00:00

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

 https://cve.radiocsirt.org/vuln/gsd-2021-29622 gsd-2021-29622 2026-10-02T23:28:34.455912+00:00 gsd-2021-29622 https://cve.radiocsirt.org/vuln/msrc_cve-2021-29622 msrc_CVE-2021-29622 — Arbitrary redirects under /new endpoint 2026-10-02T23:28:34.455923+00:00 msrc_CVE-2021-29622 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1162-1 openSUSE-SU-2021:1162-1 — Security update for SUSE Manager Client Tools 2026-10-02T23:28:34.455938+00:00

Security update for SUSE Manager Client Tools

 https://cve.radiocsirt.org/vuln/rhsa-2021:2438 RHSA-2021:2438 — Red Hat Security Advisory: OpenShift Container Platform 4.8.2 bug fix and security update 2026-10-02T23:28:34.455955+00:00

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) nodejs-y18n: prototype pollution vulnerability etcd: Large slice causes panic in decodeRecord method etcd: DoS in wal/wal.go etcd: directories created via os.MkdirAll are not checked for permissions etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS etcd: no authentication is performed against endpoints provided in the --endpoints flag jwt-go: access restriction bypass vulnerability nodejs-glob-parent: Regular expression denial of service nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation containernetworking-cni: Arbitrary path injection via type field in CNI configuration fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise containers/storage: DoS via malicious image go.elastic.co/apm: leaks sensitive HTTP headers during panic nodejs-lodash: command injection via template nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() nodejs-postcss: Regular expression denial of service during source map parsing nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js sanitize-html: improper handling of internationali…

 https://cve.radiocsirt.org/vuln/suse-su-2021:2664-1 SUSE-SU-2021:2664-1 — Security update for golang-github-prometheus-prometheus 2026-10-02T23:28:34.456021+00:00

Security update for golang-github-prometheus-prometheus

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29622 UBUNTU-CVE-2021-29622 2026-10-02T23:28:34.456037+00:00

Affected: Ubuntu:16.04:LTS: prometheus

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.