apache_skywalking

Protocols There are two types of protocols list here. Probe Protocol. Include the descriptions and definitions about how agent send collected metrics data and traces, also the formats of each entities. Query Protocol. The backend provide query capability to SkyWalking own UI and others. These...

SkyWalking SQLI

When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQ...

CVE-2020-9483

CVE-2020-9483 PoC de la vulnerabilidad de inyección SQL CVE-2020-9483, Apache SkyWalking Uso:python3 CVE-2020-9483.py -ip 127.0.0.1 Puedes usar este script para obtener la versión de la base de datos mediante inyección SQL. Haz clic en la estrella si te gusta este script. Si este PoC te ha ayudad...

cve-2019-9978

cve-2019-9978 Este es un script que permite explotar la vulnerabilidad CVE-2019-9978 de manera directa, pensado para su uso en desafíos Capture The Flag CTF o como prueba de concepto para pruebas de penetración. Requisitos previos Python 3 Librería Requests Instalar con pip install requests Uso 1...

CVE-2021-47928

creationtimestamp| type| source ---|---|--- 2026-09-12 10:00:08+00:00| seen| https://t.me/shimiscyberworld/1340 2026-09-13 00:00:41+00:00| seen| https://t.me/shimiscyberworld/1340...

CVE-2026-85229

UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the...

CVE-2026-71216

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

EUVD-2026-70950

UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the...

CVE-2026-85229 Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)

UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the...

CVE-2026-85229

Apache SkyWalking Booster UI is affected by a stored cross-site scripting (XSS) vulnerability (CWE-79) in its dashboard widgets . The issue stems from improper neutralization of input during web page generation and affects versions 10.2.0 through 10.4.0 . Notably, this is described as an incomple...

EUVD-2026-70923

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

CVE-2026-71216 Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

CVE-2026-71216

Apache SkyWalking (versions 9.6.0 through 11.0.0 ) contains a vulnerability in its PagerDuty alarm hook , which transmits the integration routing key over cleartext HTTP . Although PagerDuty normally serves its endpoint over HTTPS and responds to plain HTTP with a redirect, the initial POST—inclu...

CVE-2022-36203

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:25+00:00| seen| https://t.me/hackingAttack/67590 2026-09-02 01:01:39+00:00| seen| https://t.me/hackingAttack/67590 2026-09-05 11:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/67590 2026-09-06 00:00:50+00:00|...

CVE-2026-34884

SSRF via setskywalkingurl Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...

CVE-2026-34884

Apache SkyWalking MCP version 0.1.0 is affected by two vulnerabilities: an SSRF via the set_skywalking_url tool and a GraphQL expression injection in the MCP Server. Both are exploitable over the network with no privileges and no user interaction required, carrying a CVSS 3.1 score of 9.8 (Critic...

EUVD-2026-60572

SSRF via setskywalkingurl Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...

CVE-2026-34884 Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server

SSRF via setskywalkingurl Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...

GO-2026-5310 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp...

CVE-2026-34476

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...