EUVD-2026-85773

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

CVE-2026-97056

SigNoz versions v0.98.0 through v0.142.x are vulnerable to insufficient session expiration when using the opaque session tokenizer . The root cause is that the UpdatePasswordByResetPasswordToken and DeleteUser code paths fail to call DeleteTokensByUserID, leaving cached tokens active. An attacker...

EUVD-2026-85774

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

PT-2026-97691

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.98.0 through 0.142.0 Description When configured to use the opaque session tokenizer, the system fails to revoke existing login sessions during password resets or user deletions. This occurs because the DeleteTokensByUserID...

PT-2026-97690

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.8.0 through 0.142.0 Description Deployments that do not configure a signing secret for the JWT tokenizer use an empty string as the default HMAC key for signing and verifying session tokens. This occurs because the...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PT-2026-102786

vLLM through 0.29.0 fails to properly validate bad words token indices against the model's generation output width in SamplingParams.update from tokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests...

PT-2026-95873

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The software fails to properly validate bad words token indices against the model's generation output width within the SamplingParams.update from tokenizer function. This allows attackers to provide...

CVE-2026-93840

vLLM before 0.29.0 validates allowedtokenids against tokenizer length instead of model output logits width in SamplingParams.validateallowedtokenids. Attackers can supply token IDs above the output vocabulary that pass validation, causing LogitBiasState to corrupt GPU logits state and allow...

DEBIAN-CVE-2026-92597

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...

CVE-2026-90698

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function tryreadcommandasciiauth of the file prototext.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit...

DEBIAN-CVE-2026-90698

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function tryreadcommandasciiauth of the file prototext.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit...

CVE-2026-90698

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function tryreadcommandasciiauth of the file prototext.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit...