CLEANSTART-2026-ZO32580 Apache Airflow's XCom `GET /api/v2/{

Security vulnerability affects the airflow-3 package. Apache Airflow's XCom GET /api/v2/...

CLEANSTART-2026-TQ39648 Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_...

Security vulnerability affects the airflow-3 package. The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for...

CLEANSTART-2026-XI09971 Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET...

Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in...

CLEANSTART-2026-YJ89488 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

CLEANSTART-2026-PK52336 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-AD70544 JLine is a Java library for handling console input

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

CLEANSTART-2026-QX36211 JLine is a Java library for handling console input

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

CLEANSTART-2026-IR34711 JLine is a Java library for handling console input

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

CLEANSTART-2026-DU73207 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

CLEANSTART-2026-EA15585 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-VT81725 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

CLEANSTART-2026-MV69619 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

CLEANSTART-2026-IA44862 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-LM18724 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-SB52604 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

CLEANSTART-2026-WT65883 bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep

Security vulnerability affects the airflow-3 package. A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep...

CLEANSTART-2026-NB81003 Security fix for GHSA-r7wm-3cxj-wff9 applied in: apache-nifi 2.5.0-r0

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VC78529 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...

CLEANSTART-2026-GJ69600 Apache NiFi 0

Security vulnerability affects the apache-nifi package. Apache NiFi 0...

CLEANSTART-2026-AE51081 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...