CLEANSTART-2026-VX47769 SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9

Security vulnerability affects the nfs-subdir-external-provisioner package. The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9...

CLEANSTART-2026-BY73125 issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input

Security vulnerability affects the nfs-subdir-external-provisioner package. An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...

CLEANSTART-2026-WM37561 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the nfs-subdir-external-provisioner package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CLEANSTART-2026-NO33233 tar

Security vulnerability affects the nfs-subdir-external-provisioner package. tar...

CLEANSTART-2026-WY63823 OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go

Security vulnerability affects the nfs-subdir-external-provisioner package. OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go...

CLEANSTART-2026-GH89001 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients

Security vulnerability affects the nfs-subdir-external-provisioner package. clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients...

CLEANSTART-2026-LJ53921 ParseAddress function constructs domain-literal address components through repeated string concatenation

Security vulnerability affects the nfs-subdir-external-provisioner package. The ParseAddress function constructs domain-literal address components through repeated string concatenation...

CLEANSTART-2026-DN40757 opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go

Security vulnerability affects the nfs-subdir-external-provisioner package. opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go...

CLEANSTART-2026-TT67272 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Security vulnerability affects the nfs-subdir-external-provisioner package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

CLEANSTART-2026-FV79871 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Security vulnerability affects the nfs-subdir-external-provisioner package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input...

CLEANSTART-2026-KA25006 Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

Security vulnerability affects the nfs-subdir-external-provisioner package. Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method...

CLEANSTART-2026-TK74807 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...

CLEANSTART-2026-RQ61513 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Security vulnerability affects the nfs-subdir-external-provisioner package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have...

CLEANSTART-2026-QN19137 httpTokenCacheKey uses path

Security vulnerability affects the nfs-subdir-external-provisioner package. httpTokenCacheKey uses path...

CLEANSTART-2026-PY90502 Applications and libraries which misuse connection

Security vulnerability affects the nfs-subdir-external-provisioner package. Applications and libraries which misuse connection...

CLEANSTART-2026-HI24388 When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in i...

Security vulnerability affects the nfs-subdir-external-provisioner package. When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place...

CLEANSTART-2026-AN49609 Within HostnameError

Security vulnerability affects the nfs-subdir-external-provisioner package. Within HostnameError...

CVE-2026-110212

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212

The Stonewuu ai-fusion-video application (through version 1.2.0 ) is vulnerable to a path traversal vulnerability (CWE-22) in the media upload functionality. Authenticated users can leverage the subDir parameter of the POST /api/storage/upload endpoint to write files outside the intended media di...

CVE-2026-110212 ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...