EUVD-2026-40141

SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules...

CVE-2026-57956 SigNoz 0.130.1 - Cross-Organization Insecure Direct Object Reference in Alert Rules

SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules...

CVE-2026-57956 SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules...

CVE-2026-57955 SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

EUVD-2026-40140

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57955 SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57955

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57955

SigNoz versions up to 0.130.1 are affected by a SQL injection in the alert-history endpoints. The issue arises from unsanitized rule ID interpolation into ClickHouse queries, allowing authenticated attackers to inject URL-encoded quotes via the rule ID path parameter. The consequence is potential...

CVE-2026-57955 SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

Malicious Package

Overview autotel-devtools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-50765

creationtimestamp| type| source ---|---|--- 2026-06-29 14:50:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgqdgkp4h2e 2026-06-29 17:28:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgz7galim25...

CERTFR-2026-ACT-028

creationtimestamp| type| source ---|---|--- 2026-06-29 13:18:55+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mpglahrxgg2r 2026-06-29 13:19:01+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116833591913906031 2026-06-30 09:08:15+00:00| seen|...

CVE-2026-49991

creationtimestamp| type| source ---|---|--- 2026-06-29 01:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfby6r6fp2x 2026-06-29 05:10:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpfpwvwcr226...

CVE-2026-57955: Improper Neutralization of Special Elements used in an SQL Command

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-57956: Authorization Bypass Through User-Controlled Key

SigNoz through 0.130.1 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules...

PT-2026-53674

Name of the Vulnerable Software and Affected Versions SigNoz versions prior to 0.130.2 Description Broken access control allows authenticated users to access alert rules of other organizations. This occurs because the alert rule store predicates fail to filter by organization ID, resulting in a...

PT-2026-53673

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...

CVE-2026-52782

creationtimestamp| type| source ---|---|--- 2026-06-26 23:50:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpa54vks5o2c 2026-06-28 20:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mper7mwwdo2x 2026-06-29 14:42:42+00:00| seen|...

CVE-2026-57922

creationtimestamp| type| source ---|---|--- 2026-06-26 14:03:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp74dkh5tj2c...

CVE-2026-55667

creationtimestamp| type| source ---|---|--- 2026-06-26 14:01:48+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp74aezucd2b 2026-07-20 22:37:35+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr...