CVE-2026-16514 Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

SUSE CVE-2026-93167

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

Linux Distros Unpatched Vulnerability : CVE-2026-81869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforc...

Linux Distros Unpatched Vulnerability : CVE-2026-93167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv...

CVE-2026-50277

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277

dd-trace-cpp (Datadog's C++ distributed tracing library) prior to 2.1.0 parses incoming W3C baggage headers on the extraction path without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits, even though those limits are applied during injection. A remote unauthenticated att...

EUVD-2026-82423

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-50277 dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on the extraction path, even though those limits are enforced during injection. A remote...

CVE-2026-93292

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93167

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

DEBIAN-CVE-2026-93167

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

AZL-102876 CVE-2026-93167 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

CVE-2026-93292 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93292 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93167

CVE-2026-93167 affects the Linux kernel on C-SKY ABIv2 architectures. In the syscall trace path , the code adjusts the stack pointer (sp ) before loading the 5th and 6th syscall arguments (a4/a5) from pt_regs . Because those register-save offsets are relative to the original pt_regs base, reading...

CVE-2026-93167 csky: Fix a4/a5 restoration in syscall trace path

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

EUVD-2026-82275

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

PT-2026-95006

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0 Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span...