These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-93292 debrief based on the supplied source corpus. The CVE record was published on 2026-09-17T17:18:16.903Z and has not been modified since then. SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject [truncated]
CVE-2026-92729 debrief based on the supplied source corpus. The CVE record was published on 2026-09-16T19:18:06.833Z and has not been modified since then. SigNoz versions 0.88.0 through 0.141.0 are affected by a vulnerability allowing unauthenticated access to trace-funnel analytics endpoints. This could lead to unauthorized access to sensitive data and disruption of analytics services. Defenders should a [truncated]
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID. The alert rule store predicates fail to filter by organization ID, enabling attackers to read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check and bypassing multi-tenan [truncated]