Observability & Monitoring

Config change

dozzle v10.6.12 Security relevant · 13h

Auth RBAC

Auth requirement + command palette + password fix

Open

Upgrade now

loki v3.7.4 Security relevant · 2d

Dependencies

Security patches + deps bump

Open

Upgrade now

sftpgo v2.7.5 Security relevant · 9d

Auth

SSH channel request fix

Open

Upgrade now

prometheus v3.5.5 Security relevant · 17d

Dependencies

CVE-2026-53606 fix

Open

Review required

Cloudlog 2.8.15 Security relevant · 21d

Auth RCE / SSRF

Database query hardening

Open

Review required

BeamWeaver v0.1.9 Security relevant · 23d

Auth RBAC RCE / SSRF

Critical security fixes

Open

Upgrade now

Logsonic v1.4.1 Security relevant · 25d

Dependencies

Dependency security fix

Open

Upgrade now

Icinga v2.14.9 Security relevant · 27d

Auth RBAC RCE / SSRF

Critical security fixes

Open

Upgrade now

prometheus v3.5.4 Security relevant · 1mo

Auth Dependencies

Secrets exposure fix + dependency bumps

Open

No immediate action

grafana v12.2.9 Security relevant · 1mo

CVE fixes + Docker + Go update

Open

Upgrade now

loki v3.6.11 Security relevant · 2mo

Dependencies

CVE fixes

Open

grafana v12.3.6+security-04 Security relevant · 2mo

⚠ Upgrade required

• Alertmanager config updates no longer error when autogenerated receivers are present.

Security fixes

• CVE-2026-28374
• CVE-2026-28376
• CVE-2026-28383

VictoriaMetrics v1.136.9 Security relevant · 2mo

Security fixes

• Upgrade Go builder to version 1.26.3, addressing security issues listed in the Go 1.26.3 changelog.

Wavelog 2.4.2 Security relevant · 2mo

⚠ Upgrade required

• If unable to update immediately, block external access to the /install/ directory at your webserver level as a temporary mitigation.
• A full security advisory will be published in approximately 30 days.

Security fixes

• Fixed critical vulnerability affecting all Wavelog installations from version 1.8 onward; temporary mitigation: block external access to /install/ directory.

Notable features

• Lightweight search page for qrz.com embedding
• User agent added for JWKS request in SSO implementation
• Option to skip first login wizard for clubstation members

kubetail cli/v0.17.0 Security relevant · 2mo

⚠ Upgrade required

• Remove invalid --upload flag from cosign sign in release workflow

Security fixes

• Prevent client‑supplied X-Forwarded-Authorization from shadowing service‑account-token
• Harden CSRF token handling
• Stop trusting X-Forwarded-* headers in same-origin check

Notable features

• Support forwarded host in same-origin check
• Relax hex requirement for session key-pairs
• Trigger publish workflows only on stable releases

kite v0.11.0 Security relevant · 2mo

Security fixes

• Fixed security vulnerability in API key authentication affecting versions v0.7.0 through v0.10.0

Notable features

• New resource overview dashboard
• User‑controlled display scale setting

prometheus v3.11.3 Security relevant · 3mo

Security fixes

• AzureAD OAuth client_secret exposed in plaintext via /-/config endpoint (CVE-2026-42151, GHSA-wg65-39gg-5wfj)
• Remote-read snappy-compressed requests with excessive decoded length (CVE-2026-42154, GHSA-8rm2-7qqf-34qm)
• Old UI stored XSS via unescaped le label values in heatmap (GHSA-fw8g-cg8f-9j28)

VictoriaMetrics v1.122.21 Security relevant · 3mo

Security fixes

• Go builder upgraded from 1.25.9 to 1.26.2
• Alpine base image upgraded from 3.23.3 to 3.23.4

wazuh v4.14.5 Security relevant · 3mo

Security fixes

• DAPI callable resolution restriction
• Buffer overflow in analysisd regex match
• Path traversal in authd via agent group name

tools v0.5.0 Security relevant · 3mo

Security fixes

• Fix(rss): prevent path traversal via unvalidated feed_id in get_feed_file_path.