CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs-fips, crossplane-provider-aws-lambda-fips, amazon-cloudwatch-agent, crossplane-provider-aws-eks-fips, nrdot-collector-k8s-fips, grafana-alloy, crossplane-provider-aws-route53-fips, crossplane-provider-aws-elasticache-fips,...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs-fips, crossplane-provider-aws-lambda-fips, amazon-cloudwatch-agent, crossplane-provider-aws-eks-fips, nrdot-collector-k8s-fips, grafana-alloy, crossplane-provider-aws-route53-fips, crossplane-provider-aws-elasticache-fips,...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

AZL-81306 CVE-2026-32287 affecting package azl-otel-collector 0.127.0-1

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true"...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, crossplane-provider-family-aws, trivy-operator, terraform-provider-grafana, gitlab-runner, grafana-alloy, crossplane-provider-aws-cloudformation, pulumi-language-yaml, splunk-otel-collector, crossplane-provider-aws-sqs, k3s,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, crossplane-provider-family-aws, trivy-operator, terraform-provider-grafana, gitlab-runner, grafana-alloy, crossplane-provider-aws-cloudformation, pulumi-language-yaml, splunk-otel-collector, crossplane-provider-aws-sqs, k3s,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: linkerd2-fips, gpu-operator-fips, polaris, flux-operator-fips, emissary, crossplane-provider-aws-cloudwatchlogs-fips, dex-fips, crossplane-provider-aws-lambda-fips, pulumi-language-yaml, bento-fips, crossplane-provider-terraform-fips, flux-operator, grafana-mimir,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: linkerd2-fips, gpu-operator-fips, polaris, flux-operator-fips, emissary, crossplane-provider-aws-cloudwatchlogs-fips, dex-fips, crossplane-provider-aws-lambda-fips, pulumi-language-yaml, bento-fips, crossplane-provider-terraform-fips, flux-operator, grafana-mimir,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, syft, kuma, prometheus-adapter, gcp-compute-persistent-disk-csi-driver-fips, kubescape, headlamp, vcluster, task, docker, blob-csi-fips, zot, argo-workflows-fips, kubernetes-csi-external-snapshotter, velero-fips, longhorn-manager-fips,...

AZL-78653 CVE-2026-27141 affecting package azl-otel-collector 0.127.0-1

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, vault-benchmark, openfga, src-fingerprint, spegel, golangci-lint, metacontroller, spire-controller-manager, wuzz, pguser, postgres-operator, kor, crossplane-provider-aws-cloudwatchlogs, istio, prometheus, cis-operator, falco-no-driver,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, vault-benchmark, openfga, kratos, spegel, src-fingerprint, golangci-lint, metacontroller, spire-controller-manager, wuzz, pguser, postgres-operator, kor, crossplane-provider-aws-cloudwatchlogs, istio, prometheus, cis-operator, falco-no-driver,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner, node-feature-discovery-fips, vault-csi-provider-fips, ip-masq-agent, syft, kubernetes-secret-generator, gofumpt, grpcurl-fips, kuma, newrelic-infra-operator, pulumi-kubernetes-operator, clickhouse-operator-fips,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner, node-feature-discovery-fips, vault-csi-provider-fips, ip-masq-agent, syft, kubernetes-secret-generator, gofumpt, grpcurl-fips, kuma, newrelic-infra-operator, pulumi-kubernetes-operator, clickhouse-operator-fips,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner, node-feature-discovery-fips, vault-csi-provider-fips, ip-masq-agent, syft, kubernetes-secret-generator, newrelic-infra-operator, grpcurl-fips, kuma, clickhouse-operator-fips, gcp-compute-persistent-disk-csi-driver-fips, dex-fips,...

AZL-76790 CVE-2025-58190 affecting package azl-otel-collector 0.127.0-1

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

Malicious Package

Overview ostk-otel-autoconfig is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

AZL-75372 CVE-2025-11065 affecting package azl-otel-collector 0.127.0-1

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

MAL-2026-511 Malicious code in ostk-otel-autoconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b222e0d41ae144cf784f7fd2c40bd0c9bcb213c76581f4f9285f6f5d3baf36a The package ostk-otel-autoconfig was found to contain malicious code. Source: ghsa-malware...

Malicious code in ostk-otel-autoconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b222e0d41ae144cf784f7fd2c40bd0c9bcb213c76581f4f9285f6f5d3baf36a The package ostk-otel-autoconfig was found to contain malicious code. Source: ghsa-malware...