CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...

CLEANSTART-2026-XR18271 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...

CLEANSTART-2026-IE92648 client may issue specially crafted HTTP/1

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

CLEANSTART-2026-PX58451 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...

CLEANSTART-2026-EA97597 Netty (io

Security vulnerability affects the solr package. Netty io...

CLEANSTART-2026-HW50386 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the solr package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-AW63553 jackson-databind binds a JSON string to a javax

Security vulnerability affects the solr package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-XV17458 TypeDeserializerBase

CVE-2026-91776 affects multiple packages. TypeDeserializerBase. See references for individual vulnerability details...

CLEANSTART-2026-QM61643 jackson-databind's deserializer for java

Security vulnerability affects the solr package. jackson-databind's deserializer for java...

CLEANSTART-2026-XB73842 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-NY89801 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-NV45884 Apache Log4j's JsonTemplateLayout https://logging

Security vulnerability affects the spark-sc213-jdk17-py312 package. Apache Log4j's JsonTemplateLayout https://logging...

CLEANSTART-2026-PM70548 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106453 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-TX68944 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106451 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-MS32897 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-ZR73377 Security fix for GHSA-jcj7-v34w-v9vv applied in: valkey 9.1.2-r0

Security vulnerability affects the valkey package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TY09591 Security fix for GHSA-fq2f-crmw-q97r applied in: valkey 9.1.2-r0

Security vulnerability affects the valkey package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VA16000 Improper access control in subsystem for BlueZ before version 5

Security vulnerability affects the bluez package. Improper access control in subsystem for BlueZ before version 5...

CLEANSTART-2026-ZX34882 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CLEANSTART-2026-KA88072 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...

CLEANSTART-2026-VI85539 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-SA69441 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-HU64344 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-WY73031 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-NZ57247 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-QO55945 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-LD70674 When http

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...

CLEANSTART-2026-PW41000 Security fix for GHSA-6v7p-g79w-8964 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XM81599 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Security vulnerability affects the k8s-sidecar package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CLEANSTART-2026-QB58393 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-JM52525 Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PH12494 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-PZ20042 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-ZA90599 Security fix for CVE-2026-49265 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RH44885 Alertmanager handles alerts sent by client applications such as the Prometheus server

Security vulnerability affects the grafana package. Alertmanager handles alerts sent by client applications such as the Prometheus server...

CLEANSTART-2026-OX34995 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-DG38961 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the grafana package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-UX80273 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-WE83392 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-VM49964 ApostropheCMS is an open-source Node

Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...

CLEANSTART-2026-JI81850 ### Summary When `qs

Security vulnerability affects the n8n package. Summary When qs...

CLEANSTART-2026-OT92390 ### Summary `qs

Security vulnerability affects the n8n package. Summary qs...

CLEANSTART-2026-UQ77202 Hono is a Web application framework that provides support for any JavaScript runtime

Security vulnerability affects the n8n package. Hono is a Web application framework that provides support for any JavaScript runtime...

CLEANSTART-2026-WP11849 Security fix for GHSA-3f6p-5ww8-9rcr applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...