[ Vendor · 2 CVEs ]
@opentelemetry
CVEs affecting @opentelemetry published in the last 30 days, plus any @opentelemetry CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112006 | 18 Oct 2026 | CVSS 6.5 | opentelemetry-exporter-otlp-proto-httpOpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS… | |
| CVE-2026-104872 | 2 Oct 2026 | CVSS 5.8 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0… | Fix |