AZL-88329 CVE-2026-39832 affecting package telegraf for versions less than 1.31.0-22

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all...

AZL-88362 CVE-2026-39828 affecting package telegraf for versions less than 1.31.0-23

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError...

AZL-88353 CVE-2026-39830 affecting package telegraf for versions less than 1.31.0-22

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close, resulting in a resource leak per connection. Unsolicited global responses are now discarded...

AZL-88326 CVE-2026-39833 affecting package telegraf 1.31.0-28

The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring now returns an error when...

AZL-88356 CVE-2026-39829 affecting package telegraf for versions less than 1.31.0-22

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

AZL-88320 CVE-2026-39827 affecting package telegraf for versions less than 1.31.0-23

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for...

CVE-2026-42154 affecting package telegraf for versions less than 1.31.0-20

CVE-2026-42154 affecting package telegraf for versions less than 1.31.0-20. A patched version of the package is available...

CVE-2026-41602 affecting package telegraf for versions less than 1.31.0-20

CVE-2026-41602 affecting package telegraf for versions less than 1.31.0-20. A patched version of the package is available...

CVE-2026-44740 vulnerabilities

Vulnerabilities for packages: rancher-fleet, external-secrets-operator, scorecard, telegraf, rclone, terragrunt, flux, gitaly, teleport, argo-cd, syft, cerbos...

GHSA-M3XC-H892-GGX6 vulnerabilities

Vulnerabilities for packages: rancher-fleet, external-secrets-operator, scorecard, telegraf, rclone, terragrunt, flux, gitaly, teleport, argo-cd, syft, cerbos...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, opentelemetry-collector, metrics-server, karma, opentelemetry-operator, minio, trillian, k8sgpt, fluent-bit-plugin-loki, tempo, certificate-transparency, loki, datadog-agent, mc, minio-object-browser, aws-otel-collector, telegraf, jaeger,...

Malicious code in 1mi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a68ec5fa97918431510ba9ef57d3d601738891094478b5ebf996a3eafa0cb960 This package masquerades as a Cloudflare Worker Telegraf middleware README: 'cfworker-middware-telegraf' but its main module unconditionally forwards...

CVE-2026-5160 affecting package telegraf for versions less than 1.31.0-19

CVE-2026-5160 affecting package telegraf for versions less than 1.31.0-19. A patched version of the package is available...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, opentelemetry-collector, metrics-server, karma, opentelemetry-operator, minio, trillian, k8sgpt, fluent-bit-plugin-loki, tempo, certificate-transparency, loki, datadog-agent, mc, minio-object-browser, aws-otel-collector, telegraf, jaeger,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: prometheus, opentelemetry-collector-fips, beats, k8sgpt, tempo-fips, minio, trillian-fips, istio-fips, trillian, prometheus-fips, ld-relay, ld-relay-fips, opentelemetry-operator-fips, elastic-agent-fips, metrics-server, telegraf, karma-fips, datadog-agent-fips,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: spicedb-fips, openfga-fips, openbao, grafana-alloy, peerdb-flow, gitness, trillian-fips, chainloop-control-plane-fips, gitlab-cng, flyte, juicefs, telegraf, seaweedfs-rocksdb, commercial-expanso-edge, migrate, ferretdb, jitsucom-bulker, step-ca, dapr-fips,...

Photon OS 5.0: Telegraf PHSA-2026-5.0-0841

An update of the telegraf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0841. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0841

Updates of 'grpc', 'telegraf' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-0841

Updates of 'telegraf', 'grpc' packages of Photon OS have been released...

AZL-86607 CVE-2026-42154 affecting package telegraf for versions less than 1.31.0-22

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint /api/v1/read does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a sma...