683 matches found
CLEANSTART-2026-KA88072 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...
CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CLEANSTART-2026-WY73031 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
CLEANSTART-2026-WE83392 urllib3 is an HTTP client library for Python
Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...
CLEANSTART-2026-XD86126 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
CLEANSTART-2026-VZ78650 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-HG25385 Security fix for GHSA-6vj9-mwq6-2f5v applied in: langfuse 4.35.0-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-RP19895 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4
Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...
CLEANSTART-2026-OI68179 BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli
Security vulnerability affects the openjdk11 package. The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...
CLEANSTART-2026-YZ53862 Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files
Security vulnerability affects the gst-plugins-good package. Integer overflow in matroskademux element in gstmatroskademuxaddwvpkheader function which allows a heap overwrite while parsing matroska files...
CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...
CLEANSTART-2026-UX80273 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...
CLEANSTART-2026-QS30975 Contour is a Kubernetes ingress controller using Envoy proxy
CVE-2026-50149 affects multiple packages. Contour is a Kubernetes ingress controller using Envoy proxy. See references for individual vulnerability details...
CLEANSTART-2026-DV71311 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...
CLEANSTART-2026-NG57316 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-69192 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...
CLEANSTART-2026-QD83498 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking...
CLEANSTART-2026-PO41375 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE...
CLEANSTART-2026-XR85371 Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE product of Oracle Java SE component: Hotspot...
CLEANSTART-2026-SF23632 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Security vulnerability affects the openjdk11 package. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security...
CLEANSTART-2026-IL49737 Chatwoot is a customer engagement suite
Security vulnerability affects the openjdk11 package. Chatwoot is a customer engagement suite...
CLEANSTART-2026-JN25142 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...
CLEANSTART-2026-SA69441 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...
CLEANSTART-2026-ZA90599 Security fix for CVE-2026-49265 applied in: k8s-sidecar 2.8.2-r1
Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-OX34995 urllib3 is an HTTP client library for Python
Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...
CLEANSTART-2026-QS01923 vm2 before 3
Security vulnerability affects the n8n package. vm2 before 3...
CLEANSTART-2026-WO73143 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...
CLEANSTART-2026-DC12492 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...
CLEANSTART-2026-ST70744 NewNTUnicodeString does not check for string length overflow
CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...
CLEANSTART-2026-DB70644 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...
CLEANSTART-2026-TK74807 net/url package does not set a limit on the number of query parameters in a query
Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...
CLEANSTART-2026-ZN15240 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...
CLEANSTART-2026-OF14206 RabbitMQ amqp091-go is a Go AMQP 0
Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...
CLEANSTART-2026-YH75013 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node
CVE-2026-85525 affects multiple packages. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node. See references for individual vulnerability details...
CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...
CLEANSTART-2026-AS15122 Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform
Security vulnerability affects the strimzi-kafka-operator package. Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform...
CLEANSTART-2026-MH58992 snappy-java through 1
Security vulnerability affects the elasticsearch package. snappy-java through 1...
CLEANSTART-2026-RU43979 snappy-java through 1
Security vulnerability affects the elasticsearch package. snappy-java through 1...
CLEANSTART-2026-SW67186 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token
CVE-2026-102422 affects multiple packages. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. See references for individual vulnerability details...
CLEANSTART-2026-PJ93334 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security...
CLEANSTART-2026-JG13068 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...
CLEANSTART-2026-DM25674 Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE product of Oracle Java SE component: Javadoc...
CLEANSTART-2026-FG01449 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Scripting...
CLEANSTART-2026-BT70378 Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE product of Oracle Java SE component: Hotspot...
CLEANSTART-2026-IB41826 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE...
CLEANSTART-2026-HH17714 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library)
Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Library...
CLEANSTART-2026-YJ06011 go-git is a highly extensible git implementation library written in pure Go
Security vulnerability affects the openjdk11 package. go-git is a highly extensible git implementation library written in pure Go...
CLEANSTART-2026-SR74236 DOS / potential heap overwrite in qtdemux using zlib decompression
Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in qtdemux using zlib decompression...
CLEANSTART-2026-UX87470 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...