61 matches found
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2904 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)
@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2970 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)
@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +869 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-oracledb (>=0.27.0, <=0.45.0)
@opentelemetry/instrumentation-oracledb NPM version =0.27.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.7, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488,...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2913 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)
@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory:...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2873 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-tedious (>=0.4.0, <=0.39.0)
@opentelemetry/instrumentation-tedious NPM version =0.4.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisor...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2913 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)
@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory:...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2954 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql2 (>=0.26.0, <=0.66.0)
@opentelemetry/instrumentation-mysql2 NPM version =0.26.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisor...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2904 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)
@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2970 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)
@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2954 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql2 (>=0.26.0, <=0.66.0)
@opentelemetry/instrumentation-mysql2 NPM version =0.26.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisor...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +3217 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)
@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory:...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +1628 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-cassandra-driver (>=0.27.1, <=0.65.0)
@opentelemetry/instrumentation-cassandra-driver NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.3.4-0, =5.1.1-staging.260347880488, =6.0.3 and more Sourc...
GHSA-QQMP-WF37-98F9 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +1628 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-cassandra-driver (>=0.27.1, <=0.65.0)
@opentelemetry/instrumentation-cassandra-driver NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.3.4-0, =5.1.1-staging.260347880488, =6.0.3 and more Sourc...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +3217 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)
@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory:...
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +869 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-oracledb (>=0.27.0, <=0.45.0)
@opentelemetry/instrumentation-oracledb NPM version =0.27.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.7, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488,...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2873 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-tedious (>=0.4.0, <=0.39.0)
@opentelemetry/instrumentation-tedious NPM version =0.4.0, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisor...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2913 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)
@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-104872 Source advisory:...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +1628 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-cassandra-driver (>=0.27.1, <=0.65.0)
@opentelemetry/instrumentation-cassandra-driver NPM version =0.27.1, =0.1.0, =0.1.0-dev.00aaa03, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.3.4-0, =5.1.1-staging.260347880488, =6.0.3 and more Sourc...