CLEANSTART-2026-MI22504 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node

Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...

CLEANSTART-2026-UC30604 flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable

Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...

CLEANSTART-2026-GV36005 We have identified a bug in Node

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

CLEANSTART-2026-ZW37731 vulnerability has been identified in Node

Security vulnerability affects the apache-superset package. A vulnerability has been identified in Node...

CLEANSTART-2026-NF20161 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-NZ34356 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-JO53720 incomplete fix for CVE-2024-36137 leaves `FileHandle

Security vulnerability affects the apache-superset package. An incomplete fix for CVE-2024-36137 leaves FileHandle...

CLEANSTART-2026-KY64095 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-JU79609 Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file

Security vulnerability affects the apache-superset package. Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-VR96593 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-DD02110 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-KU24747 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-CJ18873 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...