Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

odd-cli (>=0.1.1, <=0.1.10), odd-collector-sdk (>=0.2.4, <=0.3.56) +4 more potentially affected by CVE-2026-46373 via sqlfluff (3.0.3)

sqlfluff PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - odd-cli =0.1.1, =0.2.4, =0.2.3, =2.0.32, =2.0.46 - sqlfluff-templater-dbt 3.0.3 - sqllineage 1.5.2 Source cves: CVE-2026-46373 Source advisory:...

Malicious code in @starmind/collector-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a028c205d18a30d3ff150b1653336fefa0ac86a6e5242811b6fb2c3283af21 The package @starmind/collector-cli was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3845 Malicious code in @starmind/collector-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a028c205d18a30d3ff150b1653336fefa0ac86a6e5242811b6fb2c3283af21 The package @starmind/collector-cli was found to contain malicious code. Source: ghsa-malware...

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path...

ALSA-2026:19135 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path...

RHEL 10 : opentelemetry-collector (RHSA-2026:19135)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:19135 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host...

RHEL 9 : opentelemetry-collector (RHSA-2026:19353)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:19353 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host litera...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

CVE-2026-41119

Technical details are not publicly provided in the supplied documents. Monitor for updates from Dell/NVD for affected products, impact, and remediation.

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle April 2026 Critical Patch Update. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle January 2026 Critical Patch Update. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows an remote attacker to cau...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: mc, tempo, splunk-otel-collector, loki, istio, trillian, karma, fluent-bit-plugin-loki, minio, k8sgpt, certificate-transparency, opentelemetry-operator, opentelemetry-collector-contrib, metrics-server, amazon-cloudwatch-agent-operator, datadog-agent,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, opentelemetry-collector-fips, trillian-fips, commercial-grafana, splunk-otel-collector-fips, loki, jaeger-fips, k8sgpt, prometheus-pushgateway-fips, certificate-transparency-fips, opentelemetry-operator, opentelemetry-collector,...

Important: Red Hat Security Advisory: Network Observability 1.11.2 for OpenShift

Network Observability 1.11 for Red Hat OpenShift. Network flows collector and monitoring solution...

OpenTelemetry Collector Contrib 安全漏洞

OpenTelemetry Collector Contrib is an extensible telemetry data collection component library developed under OpenTelemetry - CNCF. There are security vulnerabilities in versions 0.124.0 to 0.150.0 of OpenTelemetry Collector Contrib. These vulnerabilities stem from the Authenticate method not...

PT-2026-40750

An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to retrieve sensitive information...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...

com.capitalone.dashboard:api (>=3.4.25, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.6.20, <=3.7.33) +6 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.70)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.capitalone.dashboard:api =3.4.25, =3.6.20, =3.3.8, =1.2.12, =1.3.14 -...