922 matches found
CVE-2026-55701
The OpenTelemetry Collector Contrib githubreceiver component contains an authentication bypass. Prior to 0.151.0 , the handleReq() function in trace_receiver.go does not enforce the RequiredHeaders configuration on incoming webhook requests—those headers are only validated at startup in config.go...
EUVD-2026-78778
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...
CVE-2026-55701: Incorrect Authorization
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...
CLEANSTART-2026-TP13569 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
DRUPAL-CONTRIB-2026-152
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...
DRUPAL-CONTRIB-2026-143
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users...
DRUPAL-CONTRIB-2026-140
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...
DRUPAL-CONTRIB-2026-138
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...
CLEANSTART-2026-SH05010 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...
CVE-2026-79921 vulnerabilities
Vulnerabilities for packages: minio-fips, trufflehog-fips, trufflehog, nuclio-controller, guac, sftpgo-plugin-pubsub, argo-events, dapr-fips, falcosidekick, keda-fips, minio, telegraf, keda, bento-fips, versitygw, falcosidekick-fips, versitygw-fips, nuclio-controller-fips,...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.160.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.160.0-0.1.hum1.src src...
github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: OpenTelemetry Collector Contrib githubreceiver: Unauthorized data injection via authentication bypass
A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...
DRUPAL-CONTRIB-2026-131
This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input such as image alt tags in its dynamic caption script, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact...
DRUPAL-CONTRIB-2026-130
The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...
DRUPAL-CONTRIB-2026-127
This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...
DRUPAL-CONTRIB-2026-124
This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...
DRUPAL-CONTRIB-2026-118
This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...
CVE-2026-76757
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...
