282 matches found
CLEANSTART-2026-QO69280 Security fixes in tempo 2.9.5-r1
Package tempo version 2.9.5-r1 fixes 2 vulnerabilities: CVE-2026-46600, ghsa-259r-337f-4rfw...
GO-2026-6258 vulnerabilities
Vulnerabilities for packages: pulumi-language-yaml, tempo-fips, cortex, thanos-fips, cortex-fips, cortex-geomys-fips, thanos...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-73136
CVE-2026-73136 is an authentication bypass by capture-replay in ZenHive mpp (versions 0.6.1 before 0.6.4), affecting the MPP.Methods.Tempo payment verification component. When a static "memo" is configured in method_config, the function check_matched_memo_binding/3 returns a match unconditionally...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
GO-2024-2900 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector-contrib-fips, opentelemetry-collector, opentelemetry-collector-fips, opentelemetry-collector-contrib...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector-contrib-fips, spicedb, opentelemetry-collector, opentelemetry-collector-fips, opentelemetry-collector-contrib...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, spicedb, opentelemetry-collector-contrib, tempo...
GO-2024-2900 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib, tempo...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: datadog-agent, kubevela, rclone, goreleaser, mcp-grafana, gitlab-runner, grafana-alloy, tempo, k8sgpt, dagger, opentelemetry-collector-contrib, teleport, minio, witness, k3s, redpanda, terraform-mcp-server, terragrunt, grafana, prometheus, eksctl, ollama, nuclei,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: grafana-mimir, spegel, guac, tempo, opa, rqlite, k8sgpt, dagger, opentelemetry-collector-contrib, spire-server, dbmate, hubble-ui, terraform-docs, melange, ferretdb, cloudnative-pg, minio, step-ca, k3s, sops, ksops, kubernetes-csi-external-provisioner, kwok,...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: datadog-agent, mcp-grafana, prometheus-pushgateway, tempo, grafana-pyroscope, minio-operator, splunk-otel-collector, minio, istio, jaeger, minio-object-browser, cloud-sql-proxy, loki, certificate-transparency, mc, karma, trillian, telegraf, aws-otel-collector, keda...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: argo-rollouts, opentelemetry-collector, kargo, splunk-otel-collector, amazon-cloudwatch-agent, kubeflow-pipelines, tempo, grafana-alloy, argo-workflows, k8sgpt, opentelemetry-collector-contrib, nats...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: datadog-agent, metrics-server, tempo, prometheus-pushgateway, minio-operator, k8sgpt, prometheus-operator, splunk-otel-collector, minio, istio, jaeger, grafana, fluent-bit-plugin-loki, prometheus, node-problem-detector, amazon-cloudwatch-agent-operator,...
GO-2024-2918 vulnerabilities
Vulnerabilities for packages: tekton-chains, grafana-mimir, rclone, flux-kustomize-controller, up, py3-azure-identity, guac, goreleaser, tempo, thanos, wal-g, k8sgpt, opentelemetry-collector-contrib, cortex, prometheus-operator, flux-image-reflector-controller, spire-server, tkn, step-ca, trino,...
GO-2026-4985 vulnerabilities
Vulnerabilities for packages: containerd, tempo, grafana-alloy, thanos, splunk-otel-collector, ferretdb, docker-compose, kubescape, flyte, fluent-bit-plugin-loki, prometheus, distribution, gitaly, traefik, opa-envoy, loki, ingress-nginx-controller, grafana-image-renderer, kubo, datadog-agent,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: tekton-chains, containerd, envconsul, tempo, grafana-alloy, dive, k8sgpt, kapp-controller, regclient, helm-set-status, spire-controller-manager, prometheus-operator, kubernetes-dashboard, render-template, kor, rabbitmq-cluster-operator, k3s, undock, chartmuseum,...