CLEANSTART-2026-YH00671 pgjdbc is an open source postgresql JDBC Driver

Security vulnerability affects the apache-hive package. pgjdbc is an open source postgresql JDBC Driver...

CLEANSTART-2026-NM72661 Security fix for GHSA-673j-qm5f-xpv8 applied in: apache-hive 3.1.3-r3

Security vulnerability affects the apache-hive package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WS21723 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite

CVE-2026-46718 affects multiple packages. Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite. See references for individual vulnerability details...

CLEANSTART-2026-DW89349 pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Security vulnerability affects the apache-hive package. pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE...

CLEANSTART-2026-QH78239 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-BP29936 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-AM86994 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the apache-nifi-registry package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

CLEANSTART-2026-KL61134 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Security vulnerability affects the apache-nifi-registry package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...

CLEANSTART-2026-DS55761 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-nifi-registry package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-GT33551 Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password

Security vulnerability affects the apache-nifi-registry package. Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password...

CLEANSTART-2026-AA31447 Several components in Spring Security compare security-sensitive values using standard string equality (String

Security vulnerability affects the apache-nifi-registry package. Several components in Spring Security compare security-sensitive values using standard string equality String...

CLEANSTART-2026-IL27901 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...

Security vulnerability affects the apache-nifi-registry package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...

CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding

Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...

CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-GG30047 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns

Security vulnerability affects the apache-nifi-registry package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...

CLEANSTART-2026-AY37213 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces

Security vulnerability affects the apache-nifi-registry package. Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces...

CLEANSTART-2026-LZ14873 Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability

Security vulnerability affects the apache-nifi-registry package. Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability...

CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...