CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0
- Severity
- 8.3 (HIGH)
- Affected versions
- Before 1.45.0
- Fixed version
- 1.45.0
- Patch status
- Patched
- Published
- 2026-10-18T12:17:12.927
- Modified
- 2026-10-18T12:17:12.927
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
Technical summary
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
View the official NVD record for CVE-2026-112006
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
566 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-110372 |
OttoKit PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110886 |
Conversational Forms for ChatBot PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108983 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109894 |
Booktics PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111998 |
vanus
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102503 |
cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103091 |
internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112005 |
WhoDB 0.104.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-107436 |
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111999 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112021 |
snac2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112001 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-110895 |
an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-112006 |
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-112051 |
Xinference
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-110373 |
Hamid Alinia Login with phone number login-with-phone-number
Reporter: AUDIT
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111441 |
openGauss-server PATCH
Reporter: A1A479F7-907B-4AE8-A999-9148CADC9224
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-96534 |
Modern Events Calendar Lite PATCH
Reporter: CONTACT
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112015 |
Omnigent 0.3.0 PATCH
Reporter: DISCLOSURE
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112002 |
ProjectSend 2.5.0 PATCH
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-110383 |
Authorization Bypass
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108984 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-112018 |
cgltf
Reporter: DISCLOSURE
|
7.3
HIGH
|
VIEW RECORD |
| CVE-2026-110031 |
Salon Booking System PATCH
Reporter: CONTACT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-112000 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-110981 |
WP Photo Album Plus PATCH
Reporter: CONTACT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-108485 |
ThemeGrill eStore estore
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-109895 |
Arraytics Booktics booktics
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110382 |
NSquared Simply Schedule Appointments simply-schedule-appointments
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110897 |
IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112017 |
JeecgBoot PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112007 |
Schism Tracker
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112008 |
libmng
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112016 |
Netcore NR256CN
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112019 |
cgltf
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112020 |
LodePNG
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112048 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112052 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112059 |
libLAS
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-110033 |
The Salon Booking System WordPress plugin PATCH
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112009 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112010 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112013 |
libtta
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112014 |
LobsterAI PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112046 |
OW2 ASM 9.11 PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112053 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112054 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112055 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112056 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112057 |
libdvdnav PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112058 |
VideoLAN libdvdnav
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-110024 |
@fastify/jwt is a JWT utility plugin for Fastify. In PATCH
Reporter: CE714D77-ADD3-4F53-AFF5-83D477B104BB
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112049 |
Vita3K
Reporter: DISCLOSURE
|
6.7
MEDIUM
|
VIEW RECORD |
| CVE-2026-110070 |
The Modern Events Calendar Lite WordPress plugin PATCH
Reporter: CONTACT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110365 |
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110880 |
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110883 |
VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110885 |
HivePress HivePress hivepress
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112060 |
librtmp in RTMPDump
Reporter: DISCLOSURE
|
6.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-112003 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112062 |
lwIP
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112063 |
libstrophe
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112011 |
libtta
Reporter: DISCLOSURE
|
5.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-111870 |
A security flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-111871 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-111872 |
A security vulnerability
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-111873 |
Online-Examination-System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110032 |
The Salon Booking System WordPress plugin PATCH
Reporter: CONTACT
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-111990 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112025 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112027 |
cms
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112028 |
A flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112044 |
A security vulnerability
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-109937 |
The Otter Blocks WordPress plugin PATCH
Reporter: CONTACT
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-87844 |
The PickPlugins Product Designer for WooCommerce WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112047 |
OneUptime 14.0.2 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112061 |
librtmp (RTMPDump)
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111988 |
A security flaw
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112043 |
cal.com
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112111 |
The Bootstrap Shortcodes plugin for WordPress PATCH
Reporter: CVE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-110026 |
The Tasty Recipes Lite WordPress plugin PATCH
Reporter: CONTACT
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-110976 |
The AI Engine WordPress plugin PATCH
Reporter: CONTACT
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111041 |
The AI Engine WordPress plugin PATCH
Reporter: CONTACT
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112012 |
libtta
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-110035 |
The Salon Booking System WordPress plugin PATCH
Reporter: CONTACT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-110069 |
The Modern Events Calendar Lite WordPress plugin PATCH
Reporter: CONTACT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111874 |
A flaw
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112026 |
A security vulnerability
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112037 |
A flaw
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112041 |
diem
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112004 |
Teable PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112050 |
Gitify PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112112 |
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon
Reporter: CVE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-111877 |
Books4Cash
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111942 |
A weakness
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111984 |
stable-diffusion-webui
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111985 |
allocation of resources. It is possible to launch the attack remotely. The exploit
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111986 |
stable-diffusion-webui
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111987 |
stable-diffusion-webui
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-111991 |
A security vulnerability
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.