CVE-2026-84450

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84450

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84451

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-77955 affecting package unbound for versions less than 1.26.1-1

CVE-2026-77955 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93576 Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93576

CVE-2026-93576 affects Netty netty-codec-smtp , where the SMTP command-name field is not properly CRLF-validated . This is classified as an incomplete fix of the earlier CVE-2025-59419 , meaning the previous remediation did not fully address the validation gap. The Red Hat-assigned CVSS 3.1 score...

CVE-2026-93564

This vulnerability affects Netty's netty-codec-haproxy module. The root cause is a reference-count leak on grandchild ByteBuf objects within the HAProxy PROXY-v2 nested-TLV handling logic, described as an incomplete fix of PR #16881 . The CVSS 3.1 score is 7.5 (HIGH) , with a network attack vecto...

EUVD-2026-82930

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-93575

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits...

CLEANSTART-2026-CA69307 Security fix for CVE-2018-0202 applied in: clamav 0.99.4-r0

Security vulnerability affects the clamav package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GJ83396 Security fix for CVE-2012-6706 applied in: clamav 0.99.4-r0

Security vulnerability affects the clamav package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MK79765 Security fix for CVE-2019-1787 applied in: clamav 0.100.3-r0

Security vulnerability affects the clamav package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MS11283 Security fix for CVE-2022-36109 applied in: docker 20.10.18-r0, docker-fips 20.10.18-r0

CVE-2022-36109 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AC99204 Security fix for CVE-2024-29018 applied in: docker 26.0.0-r0, docker-fips 26.0.0-r0, paranoia 0.2.1-r0, rancher-agent 2.11.15-r1

CVE-2024-29018 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2025-XS19180 Security fix for CVE-2023-47470 applied in: ffmpeg 6.1-r0

Security vulnerability affects the ffmpeg package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EE78869 Security fix for CVE-2022-24834 applied in: redis 7.0.12-r0

Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YI26636 Security fix for CVE-2024-31228 applied in: redis 7.2.5-r1, valkey 7.2.7-r0

CVE-2024-31228 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DP59961 Security fix for CVE-2025-0913 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, runc 1.1.14-r0

CVE-2025-0913 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YD16450 Security fix for CVE-2025-4674 applied in: cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, harbor-registry 3.0.0.1-r2, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.6.1-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-4674 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...