7276 matches found
CLEANSTART-2026-HF44570 Critical XXE in Apache Tika tika-core (1
Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...
CLEANSTART-2026-PF53070 On Unix platforms, when listing the contents of a directory using File
CVE-2026-27139 affects multiple packages. On Unix platforms, when listing the contents of a directory using File. See references for individual vulnerability details...
CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service
Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...
CLEANSTART-2024-XJ51471 flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
Security vulnerability affects the buildah package. A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers...
CLEANSTART-2024-UY34199 flaw was found in Blender 3
Security vulnerability affects the blender package. A flaw was found in Blender 3...
CLEANSTART-2024-AJ31493 flaw was found in Blender 3
Security vulnerability affects the blender package. A flaw was found in Blender 3...
CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CLEANSTART-2026-WG16453 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-YB58885 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-TI91814 undici's retry handler can leave an already-exposed response body pending forever
Security vulnerability affects the langfuse package. undici's retry handler can leave an already-exposed response body pending forever...
CLEANSTART-2026-BZ98480 undici's experimental WebSocketStream client crashes the whole Node
Security vulnerability affects the langfuse package. undici's experimental WebSocketStream client crashes the whole Node...
CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...
CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-MI22504 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper
Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...
CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...
CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",
Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...
CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library
CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...
CLEANSTART-2026-GV24243 Serialize JavaScript to a superset of JSON that includes regular expressions and functions
Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...
CLEANSTART-2026-BI32681 Immutable
Security vulnerability affects the argo-workflows package. Immutable...
CLEANSTART-2026-SP20154 ACE vulnerability in conditional configuration file processing by QOS
Security vulnerability affects the sonarqube package. ACE vulnerability in conditional configuration file processing by QOS...
CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...
CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings
Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...
CLEANSTART-2026-XW68310 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages
Security vulnerability affects the grafana-alloy package. OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages...
CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver
Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...
CLEANSTART-2026-IP93838 Netty is a network application framework for development of protocol servers and clients
Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...
CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow
Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...
CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CLEANSTART-2026-DY58341 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
Security vulnerability affects the apache-nifi package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...
CLEANSTART-2026-MS81723 NumberInput
Security vulnerability affects the apache-nifi package. NumberInput...
CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework
CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...
CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript
Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...
CLEANSTART-2026-WC95670 nanoid (Nano ID) before 3
Security vulnerability affects the qdrant package. nanoid Nano ID before 3...
CLEANSTART-2026-GP78521 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-YH11240 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-YY11796 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-YX84195 pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service
CVE-2026-66274 affects multiple packages. A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-JV92221 authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service
CVE-2026-66276 affects multiple packages. An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-MP51710 Security fix for CVE-2019-13509 applied in: docker 18.09.8-r0, docker-fips 18.09.8-r0
CVE-2019-13509 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-TE95731 Security fix for CVE-2022-29526 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, docker 20.10.16-r0, docker-fips 20.10.16-r0, druid-exporter-fips 0.11-r0
CVE-2022-29526 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-AL73661 Security fix for CVE-2023-28842 applied in: docker 23.0.3-r0, docker-fips 23.0.3-r0, paranoia 0.2.1-r0
CVE-2023-28842 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-LT94285 Security fix for CVE-2024-23652 applied in: docker 25.0.2-r0, docker-fips 25.0.2-r0
CVE-2024-23652 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-XS03344 Security fix for CVE-2022-31144 applied in: redis 7.0.4-r0
Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-EE78869 Security fix for CVE-2022-24834 applied in: redis 7.0.12-r0
Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-NP24687 Security fix for CVE-2025-47903 applied in: consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0
CVE-2025-47903 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-IV22792 Security fix for GHSA-6v2p-p543-phr9 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0, argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, argo-events 1.6.3-r1, argo-workflows-fips 3.4.18-r0, calico-fips 3.28.5-r2, calico-fips 3.29.5-r0, clickhouse-operator 0.25.5-r0, cortex-fips 0, cosign 2.4.3-r0, cosign 2.5.3-r0, dynamic-localpv-provisioner 4.4.0-r0, falcoctl 0.11.0-r0, fluent-operator-fips 3.1.0-r4, fluent-operator-fips 3.2.0-r0, helm-fips 3.17-4-r1, k8sgpt 0.4.26-r0, kapp-controller 0.59.0-r0, kapp-controller-fips 0.59.0-r0, kor 0.3.8-r0, kor 0.4.2-r0, kor 0.5.9-r0, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-vip-fips 0.7.2-r0, kube-vip-fips 0.8.10-r0, kubernetes 1.31.13-r0, kubernetes 1.31.14-r0, kubernetes 1.32.10-r0, kubernetes 1.32.9-r0, kubernetes-fips 1.31.13-r0, kubernetes-fips 1.32.11-r0, kubernetes-fips 1.32.9-r0, kyverno-fips 1.13.6-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r6, litestream 0.5.2-r0, litestream 0.5.2-r1, local-static-provisioner 2.8.0-r0, metallb 0.14.9-r3, metrics-server-fips 0.7.2-r1, minio-operator 7.0.1-r5, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, multus-cni-fips 3.9.3-r2, multus-cni-fips 4.0.2-r2, nfs-subdir-external-provisioner-fips 4.0.17-r0, nfs-subdir-external-provisioner-fips 4.0.18-r1, node-problem-detector 0.8.19-r0, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1, postgres-operator 1.12.2-r2, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.6.1-r0, prometheus-node-exporter-fips 1.7.0-r0, prometheus-node-exporter-fips 1.8.2-r0, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, stakater-reloader 1.1.0-r0, tempo-fips 2.7.2-r0, tigera-operator-fips 1.37.2-r0, trust-manager-fips 0.16.0-r0, vault-k8s 1.4.2-r1, vault-k8s 1.5.0-r1, vault-k8s-fips 1.4.2-r0, vault-k8s-fips 1.5.0-r0, wave-fips 0.10.0-r0, wave-fips 0.7.2-r1, wave-fips 0.8.0-r1, wave-fips 0.9.0-r1, wavefront-collector-for-kubernetes 1.13.0-r0
GHSA-6v2p-p543-phr9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-QA69007 Security fix for GHSA-qxp5-gwg8-xv66 applied in: cfssl 1.5.0-r1, clickhouse-operator 0.25.5-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dynamic-localpv-provisioner 4.4.0-r0, falcoctl 0.11.0-r0, go-fips-1.24 1.24.7-r0, go1.24 1.24.11-r0, harbor-registry 3.0.0.1-r2, kserve-modelmesh-serving 0.12.0-r1, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-fips 1.31.13-r0, kubernetes-fips 1.32.11-r0, kubernetes-fips 1.32.9-r0, kyverno-fips 1.13.6-r1, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, multus-cni-fips 4.0.2-r2, opentofu-fips 1.9.4-r0, prometheus-node-exporter 1.8.0-r3, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, vault-k8s-fips 1.7.0-r0, wave-fips 0.7.2-r1, wave-fips 0.8.0-r1, wave-fips 0.9.0-r1, wavefront-collector-for-kubernetes 1.13.0-r0
GHSA-qxp5-gwg8-xv66 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-TQ69146 Security fix for GHSA-m5vv-6r4h-3vj9 applied in: kyverno-fips 1.12.7-r0, lvm-driver 1.8.1-r2, modelmesh-runtime-adapter 0.12.0-r3, velero-fips 1.13.2-r0
GHSA-m5vv-6r4h-3vj9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MR52568 Security fix for CVE-2025-22871 applied in: consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, harbor-registry 3.0.0.1-r2, ingress-nginx-controller 1.24.2-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0
CVE-2025-22871 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...