Repository navigation
Security: Linuxfabrik/monitoring-plugins
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
strongswan-connections plugin connects as root to an unvalidated --socket path, enabling DoS and monitoring-data injectionGHSA-cw8h-7h72-79v8 published
Sep 25, 2026 by markuslfModerate -
fetch() forwards the cleartext credential request body to a cross-origin host on a body-preserving 307/308 redirectGHSA-pq9x-4pp3-p5r9 published
Sep 21, 2026 by markuslfModerate -
kdump plugin: unconfined --path plus symlinked vmcore-dmesg.txt yields root file disclosure (monitoring user to root LPE)GHSA-q8c8-wxhc-3h4c published
Sep 14, 2026 by markuslfModerate -
SSRF and admin-credential exfiltration via unvalidated OIDC token_endpoint in keycloak-* pluginsGHSA-88fj-95f7-w68m published
Aug 4, 2026 by markuslfHigh -
Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)GHSA-rh9c-rqvg-f7pr published
Jul 8, 2026 by markuslfModerate -
Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)GHSA-f54c-p5vg-mr5c published
Jul 8, 2026 by markuslfModerate -
fetch() forwards credential headers across a cross-origin redirectGHSA-4jc5-g844-4x33 published
Jul 7, 2026 by markuslfModerate -
Symlink following in logfile legacy database migrationGHSA-w2gg-hx6w-24w3 published
Jul 7, 2026 by markuslfLow -
SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* pluginsGHSA-96fx-pqc3-28xv published
Jul 7, 2026 by markuslfModerate -
Local privilege escalation using embedded commandGHSA-798h-hpph-m24j published
Jun 12, 2026 by markuslfHigh