EUVD-2026-79023

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-55701

A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...

CVE-2026-55701

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

DEBIAN-CVE-2026-55701

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

CVE-2026-55701

Removed by vendor...

CVE-2026-55701

The OpenTelemetry Collector Contrib githubreceiver component contains an authentication bypass. Prior to 0.151.0 , the handleReq() function in trace_receiver.go does not enforce the RequiredHeaders configuration on incoming webhook requests—those headers are only validated at startup in config.go...

CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

EUVD-2026-78778

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

ROOT-APP-NPM-CVE-2026-50272 CVE-2026-50272 in dd-trace - Patched by Root

Root has patched CVE-2026-50272 in the dd-trace package for Root:npm. Multiple fixed versions available...

PT-2026-92042

Arista pubiceerde onlangs security advisory 0158, over twee lekken in de gRPC Network Packet Sampling Interface, gNPSI, van EOS. CVE-2026-73456 haalt een CVSS 3.1 basisscore van 10 en staat een ongeauthenticeerde gNPSI-client toe om via een request willekeurige code uit te voeren op de switch zel...

CVE-2026-55701: Incorrect Authorization

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

PT-2026-92043

Arista pubiceerde onlangs security advisory 0158, over twee lekken in de gRPC Network Packet Sampling Interface, gNPSI, van EOS. CVE-2026-73456 haalt een CVSS 3.1 basisscore van 10 en staat een ongeauthenticeerde gNPSI-client toe om via een request willekeurige code uit te voeren op de switch zel...

PT-2026-92382

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

PT-2026-92381

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-50270

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-50276

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can...