32431 matches found
AZL-103110 CVE-2026-81871 affecting package azurelinux-image-tools 1.6.0-3
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
AZL-103056 CVE-2026-81871 affecting package azl-otel-collector 0.127.0-1
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
CVE-2026-81871
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
UBUNTU-CVE-2026-81871
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...
wazuh v4.10.5
Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...
CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...
CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...
CVE-2026-92809
CVE-2026-92809 affects the PrestaShop psgdpr module (versions through 1.4.3 ). The vulnerability is an IDOR (Insecure Direct Object Reference) in GDPR consent logging: the module fails to validate that submitted consent log entries belong to the authenticated customer. An authenticated attacker c...
CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...
go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure through the processing of build scan links detected in the build log. An attacker can obtain the Develocity access key configured in the global configuration by manipulating the build log to include a malicious URL,...
CVE-2026-77407
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...
CVE-2026-77407 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...
CVE-2026-77407 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...
CVE-2026-92132
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-92132
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...