93794 matches found
CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...
Security vulnerability affects the apache-nifi-registry package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...
CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-GG30047 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
Security vulnerability affects the apache-nifi-registry package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
CLEANSTART-2026-AY37213 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces
Security vulnerability affects the apache-nifi-registry package. Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces...
CLEANSTART-2026-LZ14873 Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability
Security vulnerability affects the apache-nifi-registry package. Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability...
CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-CF84062 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit
Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CLEANSTART-2026-PE22489 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...
Security vulnerability affects the apache-nifi-registry package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent...
CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute
Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...
CLEANSTART-2026-YE65839 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-nifi-registry package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-IP81999 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active
Security vulnerability affects the apache-nifi-registry package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...
CLEANSTART-2026-BM08082 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...
Security vulnerability affects the apache-nifi-registry package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...
CLEANSTART-2026-MH81901 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments
Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...
CLEANSTART-2026-OS42010 Netty is an asynchronous, event-driven network application framework
Security vulnerability affects the apache-nifi-registry package. Netty is an asynchronous, event-driven network application framework...
CLEANSTART-2026-YT77949 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
CVE-2026-71290 affects multiple packages. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
CLEANSTART-2026-XH38250 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...