CVE-2026-92729 SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and...

CVE-2026-92729

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers over the network can submit arbitrary funnel definitions to retrieve trace analytics — including identifiers, durations, span counts, serv...

CVE-2026-92729 SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and...

CVE-2026-92729 SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and...

AZL-101142 CVE-2026-89853 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

CVE-2026-89853

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

DEBIAN-CVE-2026-89853

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

CVE-2026-89853

CVE-2026-89853 is a use-after-free in the Linux kernel's qla2xxx SCSI driver. The function qla2x00_free_fce_trace() freed the FCE DMA buffer while holding only fce_mutex, but firmware-dump consumers (qla27xx_fwdt_entry_t264(), qla25xx_copy_fce()) read that buffer under hardware_lock without acqui...

PT-2026-94031

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.10.0 through 1.32.0 Description The attribute truncation path in sdk/trace/span.go fails to enforce the AttributeValueLengthLimit for string and string-slice attributes that contain the Unicode replacement character...

CVE-2026-81869: Improper Handling of Unicode Encoding

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

PT-2026-93909

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.141.0 Description The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace...

CVE-2026-92729: Missing Authentication for Critical Function

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and...

CVE-2026-89815: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

Linux Distros Unpatched Vulnerability : CVE-2026-89853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump...

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73466

CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

EUVD-2026-79024

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...