https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:02:33.441488+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-06600 bdu:2024-06600 2026-10-03T07:02:33.477363+00:00 bdu:2024-06600 https://cve.radiocsirt.org/vuln/bit-alertmanager-2023-40577 BIT-alertmanager-2023-40577 — Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint 2026-10-03T07:02:33.477408+00:00

Affected: Bitnami: alertmanager

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

 https://cve.radiocsirt.org/vuln/cleanstart-2025-uv88153 CLEANSTART-2025-UV88153 — Alertmanager handles alerts sent by client applications such as the Prometheus server 2026-10-03T07:02:33.477446+00:00

Affected: CleanStart: alertmanager

Security vulnerability affects the alertmanager package. Alertmanager handles alerts sent by client applications such as the Prometheus server.

 https://cve.radiocsirt.org/vuln/euvd-2026-216766 EUVD-2026-216766 2026-10-03T07:02:33.477466+00:00 EUVD-2026-216766 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40577 fkie_cve-2023-40577 2026-10-03T07:02:33.477478+00:00

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

 https://cve.radiocsirt.org/vuln/ghsa-v86x-5fm3-5p7j GHSA-v86x-5fm3-5p7j — Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint 2026-10-03T07:02:33.477498+00:00

Affected: Go: github.com/prometheus/alertmanager

### Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

### Patches

Users can upgrade to Alertmanager v0.2.51.

### Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

### References

N/A

 https://cve.radiocsirt.org/vuln/gsd-2023-40577 gsd-2023-40577 2026-10-03T07:02:33.477523+00:00 gsd-2023-40577 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13599-1 openSUSE-SU-2024:13599-1 — golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media 2026-10-03T07:02:33.477534+00:00

golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:7198 RHSA-2023:7198 — Red Hat Security Advisory: OpenShift Container Platform 4.15.0 bug fix and security update 2026-10-03T07:02:33.477554+00:00

golang.org/x/net/html: Cross site scripting follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() rekor: compressed archives can result in OOM conditions goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests prometheus-alertmanager: UI is vulnerable to stored XSS via the /api/v1/alerts endpoint HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) opentelemetry: DoS vulnerability in otelhttp golang: cmd/go: Protocol Fallback when fetching modules opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics ssh: Prefix truncation attack on Binary Packet Protocol (BPP) go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

 https://cve.radiocsirt.org/vuln/suse-su-2024:0191-1 SUSE-SU-2024:0191-1 — Security Beta update for SUSE Manager Client Tools 2026-10-03T07:02:33.477587+00:00

Security Beta update for SUSE Manager Client Tools

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-40577 UBUNTU-CVE-2023-40577 2026-10-03T07:02:33.477612+00:00

Affected: Ubuntu:Pro:18.04:LTS: prometheus-alertmanager, Ubuntu:20.04:LTS: prometheus-alertmanager, Ubuntu:Pro:22.04:LTS: prometheus-alertmanager

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0148 WID-SEC-W-2025-0148 — Oracle Communications: Mehrere Schwachstellen 2026-10-03T07:02:33.477634+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.