co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59640 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512948...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

co.elastic.apm:apm-agent-attach-cli (>=1.26.0, <=1.57.1), org.codelibs.fesen.tool:fesen-plugin-cli (>=0.10.0, <=0.16.0) +1 more potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-fips (>=1.0.4, <=1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version =1.0.4, =1.26.0, =0.10.0, =1.0.0, =2.16.0 Source cves: CVE-2026-59649 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512843...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-12817 Source advisory...

co.elastic.apm:apm-agent-attach-cli (>=1.50.0, <=1.57.1), org.opensearch:opensearch-plugin-cli (>=1.3.20, <=2.16.0) potentially affected by CVE-2026-59648 via org.bouncycastle:bcpg-fips (1.0.7.1)

org.bouncycastle:bcpg-fips MAVEN version 1.0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-fips and may be impacted: - co.elastic.apm:apm-agent-attach-cli =1.50.0, =1.3.20, =2.16.0 Source cves: CVE-2026-59648 Source advisory...

apm v11.1.0

APM A better local password manager for everyone. APM is a fast, zero-knowledge CLI password manager written in Go and Rust. It stores 25+ structured secret types in a single encrypted vault — from passwords and TOTP codes to SSH keys, medical records, photos, and binary files. Two binaries ship...

apm v11.0.0

APM A better local password manager for everyone. APM is a fast, zero-knowledge CLI password manager written in Go and Rust. It stores 25+ structured secret types in a single encrypted vault — from passwords and TOTP codes to SSH keys, medical records, photos, and binary files. Two binaries ship...

Hitachi Energy APM Edge Product

SUMMARY Hitachi Energy is aware of Dirty Frag vulnerabilities that affect APM Edge product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended...

Malicious Package

Overview OCI.DotNetSDK.Apm.config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-50271

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

PYSEC-2026-2377 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

Summary Two primitive integrators in apm-cli enumerate package files with bare Path.glob / Path.rglob calls and read each match with Path.readtext, transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/.prompt.md or .apm/agents/.agent.md is...

PYSEC-2026-2378 Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

Summary Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a...

Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

SummaryMicrosoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

PYSEC-2026-2379 Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

PT-2026-59059

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

PYSEC-2026-634 APM Java Agent Local Privilege Escalation

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of...

Insertion of Sensitive Information into Log File

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the APM instrumentation. An attacker can obtain sensitive information by...

CVE-2026-49088: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File CWE-532 in Kibana can lead to information disclosure. When the optional application performance monitoring APM instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-batch-alarmsender (>=3.0.0, <=3.1.0) +5 more potentially affected by CVE-2026-57947 via com.navercorp.pinpoint:pinpoint-webhook (>=3.0.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-webhook MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 Source cves: CVE-2026-57947 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755929...

CVE-2026-46858: Undefined Security Weakness

Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager component: JADM, JVM Diagnostics. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...