CVE-2026-81870 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-81870 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-81870

OpenTelemetry-Go (versions 1.5.0–1.44.0) has an information-disclosure flaw in sdk/trace.NewTracerProvider. Its Info-level diagnostic event uses MarshalLog implementations that recursively include span processor, exporter, and client configuration. Applications that enable internal Info logging v...

CVE-2026-80975

creationtimestamp| type| source ---|---|--- 2026-09-16 19:00:02+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvnt55hfz72v...

CVE-2026-92716

creationtimestamp| type| source ---|---|--- 2026-09-16 18:50:13+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnslmavj22f...

CVE-2026-18120

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-20331

creationtimestamp| type| source ---|---|--- 2026-09-16 18:08:44+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqbgjnfe2w 2026-09-16 18:30:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnrhn76vq2t 2026-09-16 22:18:56+00:00| seen|...

CVE-2026-20306

creationtimestamp| type| source ---|---|--- 2026-09-16 18:08:27+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqavo7hq2f 2026-09-16 18:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnqvsaw762y 2026-09-16 21:18:16+00:00| seen|...

CVE-2026-20305

creationtimestamp| type| source ---|---|--- 2026-09-16 18:08:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqanoyqd2f 2026-09-16 18:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnrzig4ak2n 2026-09-16 21:16:14+00:00| seen|...

CVE-2026-20234

creationtimestamp| type| source ---|---|--- 2026-09-16 18:08:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqag4nfl2j 2026-09-16 18:30:12+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnrhpc5lt2j 2026-09-16 21:15:33+00:00| seen|...

CVE-2026-86359

creationtimestamp| type| source ---|---|--- 2026-09-16 17:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cp2ong6rm2k2q...

CVE-2026-87028

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

CVE-2026-20307

creationtimestamp| type| source ---|---|--- 2026-09-16 17:17:37+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117281853082467027 2026-09-16 18:08:35+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqb5r45f25 2026-09-16 18:40:10+00:00| seen|...

CVE-2026-18120 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-92397

creationtimestamp| type| source ---|---|--- 2026-09-16 17:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvnmmmgovj22 2026-09-16 17:44:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e7usvzdqy7jb6...

CVE-2026-92625

creationtimestamp| type| source ---|---|--- 2026-09-16 17:03:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvnmm5u45724 2026-09-16 17:07:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dj3e3yp7cz2xw...

CVE-2026-87028

CVE-2026-87028 is a cross-board Insecure Direct Object Reference (IDOR) in the Board Custom Slot Preview endpoint of Concrete CMS 9.0.0 through 9.5.3 . The endpoint failed to verify that a submitted InstanceItem belonged to the board instance the requesting user was authorized to edit, and did no...

CVE-2026-77411

creationtimestamp| type| source ---|---|--- 2026-09-16 16:11:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjq6qwgz24 2026-09-16 18:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnprymag52n...

CVE-2026-90049

creationtimestamp| type| source ---|---|--- 2026-09-16 16:10:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjog5vsz2p 2026-09-16 17:40:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnoocmrev2r 2026-09-23 04:24:43+00:00| published-proof-of-concept|...

CVE-2026-90011

creationtimestamp| type| source ---|---|--- 2026-09-16 16:09:44+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjmn7sml2g 2026-09-16 16:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnluvetf72f...