ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106450 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106450 Source advisory: SNYK:JAVA-ORGLZ4-20570525...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106452 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106452 Source advisory: OSV:GHSA-4V53-57PG-C464...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106452 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106452 Source advisory: GHSA-4V53-57PG-C464...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106452 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106452 Source advisory: SNYK:JAVA-ORGLZ4-20570532...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106453 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106453 Source advisory: GHSA-6CX8-RJF8-PR8G...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106453 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106453 Source advisory: SNYK:JAVA-ORGLZ4-20570530...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2026-106453 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106453 Source advisory: OSV:GHSA-6CX8-RJF8-PR8G...

Exploit for Improper Certificate Validation in Checkpoint Gaia_Embedded

CVE-2026-85102 — Check Point Unauthenticated VPN Tunnel Establ...

CLEANSTART-2026-HP73429 package com

Security vulnerability affects the spark package. The package com...

CLEANSTART-2026-VL27493 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the spark package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-DM89107 When audit logging is enabled (zookeeper

Security vulnerability affects the spark package. When audit logging is enabled zookeeper...

CLEANSTART-2026-QQ07895 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the spark package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-JM28284 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the spark package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-OZ91827 NumberInput

Security vulnerability affects the spark package. NumberInput...

CLEANSTART-2026-BS92319 UTF8DataInputJsonParser

Security vulnerability affects the spark package. UTF8DataInputJsonParser...

CLEANSTART-2026-DV78787 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Security vulnerability affects the spark package. Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients...

CLEANSTART-2026-GM79198 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the spark package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

CLEANSTART-2026-AV92018 TypeDeserializerBase

Security vulnerability affects the spark package. TypeDeserializerBase...

CLEANSTART-2026-SY79520 Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4

Security vulnerability affects the spark package. Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4...

CVE-2026-32773

A flaw was found in Apache Spark. The Spark History Server lacks proper Cross-Site Scripting XSS escaping, allowing a malicious Spark job to generate arbitrary unescaped frontend code. This vulnerability can be exploited by an attacker who has the ability to launch a Spark job and can trick a use...