897 matches found
GHSA-PGVV-Q3WF-MM9M OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
Summary The Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. Details The vulnerable logic is in pkg/ebpf/common/sqldetectpostgres.go. In th...
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
Summary OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointers or slice past string tables, causing the agent to panic while determining the process language. Details...
GHSA-75CM-X2W3-8MGF MLflow: unauthenticated access to certain FastAPI routes
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...
CVE-2026-2652
Summary (CVE-2026-2652) : In mlflow/mlflow
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: karma, node-problem-detector, minio, splunk-otel-collector, jaeger, datadog-agent, keda, mc, loki, opentelemetry-collector, opentelemetry-collector-contrib, k8sgpt, minio-operator, minio-object-browser, prometheus-pushgateway, metrics-server, istio,...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: keda, nrdot-collector-k8s-fips, prometheus-pushgateway-fips, ld-relay, node-problem-detector, google-cloud-otel-ops-collector, minio, certificate-transparency, telegraf, mc-fips, cloud-sql-proxy, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips,...
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Overview A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, t...
GHSA-RCGG-9C38-7XPX OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Overview A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, t...
PT-2026-41161
Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.62.0 Description A flaw in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators allows for unbounded memory allocation and CPU consumption when...
Medium: docker
Issue Overview: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may...
CVE-2026-42602
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...
GHSA-FX83-V9X8-X52W vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
GHSA-JVWF-75H9-CWGG vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
CVE-2026-44291 vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
CVE-2026-44289 vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
CVE-2026-44293 vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
CVE-2026-44288 vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...
CVE-2026-44292 vulnerabilities
Vulnerabilities for packages: cadence-web, pulumi, opentelemetry-auto-instrumentations-node, renovate, kibana, nemo, vitess, librechat, homepage, kubeflow-centraldashboard, gemini-cli...