CLEANSTART-2026-VA40669 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-NH18274 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

CVE-2026-39832 affects multiple packages. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh. See references for individual vulnerability details...

CLEANSTART-2026-BD72670 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-DM81687 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CLEANSTART-2026-FD78851 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...

CLEANSTART-2026-ZR95195 Security fix for GHSA-f6x5-jh6r-wnfv applied in: cloud-provider-aws 1.34.1-r1

Security vulnerability affects the cloud-provider-aws package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LC49486 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1, cloud-provider-aws 1.34.1-r1

GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JT34415 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-ME34886 go-git is an extensible git implementation library written in pure Go

CVE-2026-71557 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-ST96789 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-NO64330 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-NM10568 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-BO15897 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

Security vulnerability affects the apache-superset package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it...

CLEANSTART-2026-KZ38920 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the buildkitd package. A vulnerability has been found in cilium ebpf up to 0...

CLEANSTART-2026-QQ47371 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-UQ05512 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-FZ48643 Security fix for GHSA-5cgq-3rg8-m6cv applied in: ollama-fips 0.34.4-r2

Security vulnerability affects the ollama-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IE69074 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

CVE-2026-39830 affects multiple packages. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. See references for individual vulnerability details...

CLEANSTART-2026-KO65183 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

Security vulnerability affects the victoria-metrics package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...