CLEANSTART-2026-ZE47134 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-BC80499 In Eclipse Jetty, an HTTP URI of this form: /public;/

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

CLEANSTART-2026-SN03087 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

CLEANSTART-2026-KF29618 Apache NiFi 1

Security vulnerability affects the apache-nifi package. Apache NiFi 1...

CLEANSTART-2026-PV64921 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

CLEANSTART-2026-TY92460 Critical XXE in Apache Tika tika-core (1

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...

CLEANSTART-2026-XW11767 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CLEANSTART-2026-TF05670 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-AU34344 In jose4j before 0

Security vulnerability affects the apache-nifi package. In jose4j before 0...

CLEANSTART-2026-EO53976 In Eclipse Jetty versions 12

Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12...

PT-2026-109642

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 3.1.0 through 5.2.9 Description An out-of-bounds read exists during the deserialization of compact Theta sketches. The functions compact theta sketch::deserialize and wrapped compact theta sketch::wrap read...

PT-2026-109641

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 2.0.0-incubating through 5.2.9 Description An out-of-bounds read and write occurs during the deserialization of CPC sketches. A crafted serialized CPC sketch passed to the cpc sketch::deserialize function,...

PT-2026-109640

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 1.0.0-incubating through 5.2.9 Description A heap buffer overflow occurs during the HLL sketch deserialization process when operating in LIST mode from a byte buffer or stream. The issue arises because the coup...

PT-2026-109485

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcache settingscache cookie exclude parameter. This is due to the plugin registering the cache cookie exclude setting via register setting without a sanitize...

PT-2026-117846

Security vulnerability affects the apache-nifi package. ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java...

PT-2026-117867

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...

PT-2026-117760

Security vulnerability affects the apache-nifi package. Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a...

PT-2026-117891

Security vulnerability affects the apache-nifi package. Apache NiFi 1...

CVE-2026-103635: Out-of-bounds Read

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. compactthetasketch::deserialize and wrappedcompactthetasketch::wrap read header fields before checking that the input was long enough. For the compressed format, the size check could ...