CLEANSTART-2026-BT04597 Apache MINA's AbstractIoBuffer

Security vulnerability affects the apache-nifi package. Apache MINA's AbstractIoBuffer...

CLEANSTART-2026-BC80499 In Eclipse Jetty, an HTTP URI of this form: /public;/

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

CLEANSTART-2026-EB27094 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-RB25036 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

CLEANSTART-2026-TF05670 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CLEANSTART-2026-SN03087 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

CLEANSTART-2026-ZE47134 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-TY92460 Critical XXE in Apache Tika tika-core (1

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...

CLEANSTART-2026-XW11767 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-KF29618 Apache NiFi 1

Security vulnerability affects the apache-nifi package. Apache NiFi 1...

CLEANSTART-2026-OE66556 In Jakarta Mail versions prior to 2

Security vulnerability affects the apache-nifi package. In Jakarta Mail versions prior to 2...

CLEANSTART-2026-PV64921 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

CLEANSTART-2026-AU34344 In jose4j before 0

Security vulnerability affects the apache-nifi package. In jose4j before 0...

CLEANSTART-2026-EO53976 In Eclipse Jetty versions 12

Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12...

PT-2026-117859

Security vulnerability affects the apache-nifi package. The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics...

CVE-2026-103501: Heap-based Buffer Overflow

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8...

PT-2026-117840

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

PT-2026-117775

Security vulnerability affects the apache-nifi package. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...