CLEANSTART-2026-PV83976 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-SV16183 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CLEANSTART-2026-AW83562 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-HF94119 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-FL49785 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-AL79181 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-EG45890 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-IQ69841 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-HW01604 For certain crafted inputs, a 'ed25519

CVE-2026-46598 affects multiple packages. For certain crafted inputs, a 'ed25519. See references for individual vulnerability details...

CLEANSTART-2026-TR67175 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-VA40669 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-BD72670 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-FL07624 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

CVE-2026-39833 affects multiple packages. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. See references for individual vulnerability details...

CLEANSTART-2026-NH18274 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

CVE-2026-39832 affects multiple packages. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh. See references for individual vulnerability details...

CLEANSTART-2026-FD78851 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...

CLEANSTART-2026-DM81687 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CLEANSTART-2026-ZR95195 Security fix for GHSA-f6x5-jh6r-wnfv applied in: cloud-provider-aws 1.34.1-r1

Security vulnerability affects the cloud-provider-aws package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LC49486 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1, cloud-provider-aws 1.34.1-r1

GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JT34415 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-ME34886 go-git is an extensible git implementation library written in pure Go

CVE-2026-71557 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...