CLEANSTART-2026-FU44475 Security fix for GHSA-57rv-r2g8-2cj3 applied in: apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r1, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, elasticsearch 9.2.7-r0, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 39.0.1-r0

GHSA-57rv-r2g8-2cj3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AX30429 Security fix for GHSA-45q3-82m4-75jr applied in: apache-hive 4.2.0-r3, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, cassandra 5.0.8-r1, elasticsearch 9.2.7-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.11-r2, keycloak 26.5.7-r0, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 39.0.1-r0

GHSA-45q3-82m4-75jr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PE62023 Security fix for CVE-2026-42585 applied in: apache-activemq-artemis 2.56.0-r1, apache-nifi 2.9.0-r1, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, opensearch 3.6.0-r4, s3proxy 3.3.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r3, wildfly 39.0.1-r0

CVE-2026-42585 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RZ47528 Security fix for CVE-2026-42583 applied in: apache-hive 4.2.0-r3, apache-nifi 2.9.0-r1, cassandra 5.0.8-r1, cassandra-fips 5.0.6-r2, cassandra-reaper-fips 3.8.0-r9, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, confluent-common-docker 7.6.9-r4, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-fips 3.8.1-r11, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, solr 9.8.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r3, wildfly 39.0.1-r0

CVE-2026-42583 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IZ96145 Security fix for CVE-2026-42581 applied in: apache-activemq-artemis 2.56.0-r1, apache-nifi 2.9.0-r1, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, opensearch 3.6.0-r4, s3proxy 3.3.0-r1, spark 3.5.9-r2, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r3, wildfly 39.0.1-r0

CVE-2026-42581 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IT89059 Security fix for CVE-2026-42579 applied in: apache-hive 4.2.0-r3, apache-nifi 2.9.0-r1, elasticsearch 9.2.8-r0, elasticsearch 9.3.7-r1, elasticsearch 9.4.3-r1, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.1-r2, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r3, wildfly 39.0.1-r0

CVE-2026-42579 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RX83323 Security fix for CVE-2026-42577 applied in: apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r3, confluent-common-docker 7.6.9-r5, kafka-fips 3.8.1-r11, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.7-r0, keycloak 26.6.1-r1, stargate 2.0.48-r0, trino 480-r3, wavefront-proxy 13.7-r2, wavefront-proxy 13.9-r2

CVE-2026-42577 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FS84990 Security fix for CVE-2026-42198 applied in: keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r1, sonarqube 25.12.0.117093-r1, sonarqube 26.3.0.120487-r1

CVE-2026-42198 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WC20717 Security fix for CVE-2026-41417 applied in: apache-activemq-artemis 2.56.0-r1, apache-hive 4.2.0-r2, apache-nifi 2.9.0-r1, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.11-r2, keycloak 26.5.5-r1, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kserve-modelmesh 0.12.0-r17, management-api-for-apache-cassandra-5.0 0.1.118-r2, opensearch 3.6.0-r4, s3proxy 3.3.0-r1, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, trino 480-r3, wavefront-proxy 13.7-r1, wavefront-proxy 13.8-r0, wavefront-proxy 13.9-r1, wildfly 39.0.1-r0

CVE-2026-41417 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CY16294 Security fix for CVE-2026-39852 applied in: keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.6.1-r1

CVE-2026-39852 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WA32261 Security fix for CVE-2026-5598 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, elasticsearch 9.2.7-r0, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.5.7-r0, keycloak 26.6.1-r1, kserve-modelmesh 0.9.0-r1, logstash-fips 9.4.3-r1, wildfly 39.0.1-r0

CVE-2026-5598 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RB54563 Security fix for GHSA-cbdj-484d-3x9q applied in: keycloak 26.5.0-r2

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XH56428 Security fix for GHSA-5x3r-wrvg-rp6q applied in: apache-hive 4.2.0-r5, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, cloud-config-server 4.3.2-r3, elasticsearch 9.2.7-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.10-r1, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.1-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r1, strimzi-kafka-operator 1.1.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 41.0.0-r1

GHSA-5x3r-wrvg-rp6q affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NB58291 Security fix for GHSA-676x-f7gg-47vc applied in: apache-hive 4.2.0-r5, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, elasticsearch 9.2.7-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

GHSA-676x-f7gg-47vc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TY33205 Security fix for GHSA-5pvg-856g-cp85 applied in: apache-hive 4.2.0-r5, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, elasticsearch 9.2.7-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

GHSA-5pvg-856g-cp85 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FY04918 Security fix for GHSA-x4gw-5cx5-pgmh applied in: apache-hive 4.2.0-r5, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, cassandra 5.0.8-r1, cloud-config-server 4.3.2-r3, elasticsearch 9.2.7-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.10-r1, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.1-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r1, solr 9.8.1-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 41.0.0-r1

GHSA-x4gw-5cx5-pgmh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XD15428 Security fix for CVE-2026-45673 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, elasticsearch 9.3.5-r2, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-45673 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VE14667 Security fix for CVE-2026-47244 applied in: apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r3, elasticsearch 9.3.5-r2, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.4.10-r1, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.1-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r1, strimzi-kafka-operator 1.1.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 41.0.0-r1

CVE-2026-47244 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FU49566 Security fix for GHSA-3g76-f9xq-8vp6 applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, keycloak 26.4.10-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r5, spark 3.5.9-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.5.8-r0, spark-sc213-jdk17-py312 4.0.3-r0, spark-sc213-jdk17-py312 4.1.2-r0

GHSA-3g76-f9xq-8vp6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TN22845 Security fix for CVE-2026-6860 applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, keycloak 26.3.5-r3, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, spark 3.5.9-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.5.8-r0, spark-sc213-jdk17-py312 4.0.3-r0, spark-sc213-jdk17-py312 4.1.2-r0

CVE-2026-6860 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...