CLEANSTART-2026-KY64095 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-OM37971 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-NP94260 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-GV36005 We have identified a bug in Node

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

CLEANSTART-2026-NF20161 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-PD89526 Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification

Security vulnerability affects the apache-superset package. Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification...

CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node

Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...

CLEANSTART-2026-ZW37731 vulnerability has been identified in Node

Security vulnerability affects the apache-superset package. A vulnerability has been identified in Node...

CLEANSTART-2026-JU79609 Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file

Security vulnerability affects the apache-superset package. Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-VR96593 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-SQ92018 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-JK79354 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-XY63591 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...