279 matches found
CVE-2026-73136
CVE-2026-73136 is an authentication bypass by capture-replay in ZenHive mpp (versions 0.6.1 before 0.6.4), affecting the MPP.Methods.Tempo payment verification component. When a static "memo" is configured in method_config, the function check_matched_memo_binding/3 returns a match unconditionally...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-fips, tempo, opentelemetry-collector-contrib, spicedb, opentelemetry-collector-contrib-fips...
GO-2024-2900 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-fips, tempo, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, spicedb, opentelemetry-collector...
GO-2024-2900 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, opentelemetry-collector...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: ollama, malcontent, dgraph, goreleaser, nuclei, vcluster, prometheus, grafana-alloy, grafana, gitlab-runner, terragrunt, datadog-agent, dagger, k8sgpt, teleport, opentelemetry-collector, terraform-mcp-server, mcp-grafana, loki, nfpm, redpanda, minio, eksctl, rclone,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: cert-manager-cmctl, k3d, spicedb, k8sgpt-operator, vcluster, falcosidekick, grpc-health-probe, smarter-device-manager, rqlite, ksops, spegel, guac, sigstore-scaffolding, tflint, terragrunt, cilium-cli, zarf, dagger, dex, k8sgpt, kubernetes-csi-external-provisioner,...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: keda, aws-otel-collector, trillian, cloud-sql-proxy, minio-object-browser, datadog-agent, minio-operator, prometheus-pushgateway, mc, loki, mcp-grafana, grafana-pyroscope, minio, istio, karma, splunk-otel-collector, telegraf, tempo, certificate-transparency, jaeger...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, argo-rollouts, argo-workflows, k8sgpt, grafana-alloy, amazon-cloudwatch-agent, kargo, kubeflow-pipelines, splunk-otel-collector, nats, opentelemetry-collector...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: keda, aws-otel-collector, prometheus, grafana, trillian, cloud-sql-proxy, node-problem-detector, datadog-agent, k8sgpt, minio-operator, prometheus-operator, prometheus-pushgateway, opentelemetry-collector, fluent-bit-plugin-loki, mc, loki, minio, istio, metrics-serve...
GO-2024-2918 vulnerabilities
Vulnerabilities for packages: tekton-chains, goreleaser, nuclei, argo-workflows, timestamp-authority, ksops, policy-controller, harbor-registry, boring-registry, falcoctl, flux-image-reflector-controller, flux-source-controller, guac, py3-cassandra-medusa, druid, sigstore-scaffolding, terragrunt,...
GO-2026-4985 vulnerabilities
Vulnerabilities for packages: hubble, keda, falcosidekick, gitlab-kas, tkn, datadog-agent, kubo, hydra, tekton-pipelines, flux-notification-controller, prometheus-alertmanager, docker-cli-buildx, caddy, gitaly, containerd, external-secrets-operator, opentelemetry-collector-contrib, knative-servin...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: aws-application-networking-k8s, hubble, libnvidia-container, nova, nuclei, kpt, steampipe, helm-push, aws-eks-pod-identity-agent, nri-mysql, guac, docker-cli, yunikorn-k8shim, tkn, controller-gen, terraform-provider-azapi, kuberlr, rancher-system-upgrade-controller,...
CLEANSTART-2026-ZT61417 Security fixes in tempo 2.10.4-r1
Package tempo version 2.10.4-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39832...
CLEANSTART-2026-OS37166 Security fixes in tempo-fips 3.0.2-r2
Package tempo-fips version 3.0.2-r2 fixes 1 vulnerabilities: CVE-2026-41178...