features

Apr 13, 2026 GO-2026-5264 +2 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 7, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Apr 2, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 25, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 19, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Feb 17, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 7, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Jan 6, 2026 GO-2026-5264 +3 more

  GO-2026-5264: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

  GO-2026-5381: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

  GO-2026-5662: Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

  GO-2026-5710: Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Changes in this version

+ const API

+ const OTLPReceiver

+ const PromQL

+ const PromQLFunctions

+ const PromQLOperators

+ const Prometheus

+ const Rules

+ const Scrape

+ const ServiceDiscoveryProviders

+ const TSDB

+ const TemplatingFunctions

+ const UI

+ var DefaultRegistry = NewRegistry()

+ func Disable(category, name string)

+ func Enable(category, name string)

+ func Get() map[string]map[string]bool

+ func Set(category, name string, enabled bool)

+ type Collector interface

+ Disable func(category, name string)

+ Enable func(category, name string)

+ Get func() map[string]map[string]bool

+ Set func(category, name string, enabled bool)

+ func NewRegistry() Collector