CLEANSTART-2026-ZR73377 Security fix for GHSA-jcj7-v34w-v9vv applied in: valkey 9.1.2-r0

Security vulnerability affects the valkey package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VA16000 Improper access control in subsystem for BlueZ before version 5

Security vulnerability affects the bluez package. Improper access control in subsystem for BlueZ before version 5...

CLEANSTART-2026-KA88072 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...

CLEANSTART-2026-ZX34882 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CLEANSTART-2026-ML70772 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CLEANSTART-2026-SA69441 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-HU64344 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-NZ57247 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-QO55945 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-WY73031 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-VI85539 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-LD70674 When http

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...

CLEANSTART-2026-PW41000 Security fix for GHSA-6v7p-g79w-8964 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JM52525 Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QB58393 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-XM81599 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Security vulnerability affects the k8s-sidecar package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CLEANSTART-2026-OX34995 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-UX80273 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-PH12494 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-ZA90599 Security fix for CVE-2026-49265 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DG38961 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the grafana package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-PZ20042 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-RH44885 Alertmanager handles alerts sent by client applications such as the Prometheus server

Security vulnerability affects the grafana package. Alertmanager handles alerts sent by client applications such as the Prometheus server...

CLEANSTART-2026-YM59079 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the grafana package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

CLEANSTART-2026-WE83392 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-VM49964 ApostropheCMS is an open-source Node

Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...

CLEANSTART-2026-MK95197 Security fix for GHSA-rgwj-5xj2-c3m3 applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OT92390 ### Summary `qs

Security vulnerability affects the n8n package. Summary qs...

CLEANSTART-2026-JI81850 ### Summary When `qs

Security vulnerability affects the n8n package. Summary When qs...

CLEANSTART-2026-WP11849 Security fix for GHSA-3f6p-5ww8-9rcr applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UQ77202 Hono is a Web application framework that provides support for any JavaScript runtime

Security vulnerability affects the n8n package. Hono is a Web application framework that provides support for any JavaScript runtime...

CLEANSTART-2026-WQ57652 node-csv is a full-featured CSV parser with a simple API that is tested against large datasets

Security vulnerability affects the n8n package. node-csv is a full-featured CSV parser with a simple API that is tested against large datasets...

CLEANSTART-2026-ZF21057 Hono is a Web application framework that provides support for any JavaScript runtime

Security vulnerability affects the n8n package. Hono is a Web application framework that provides support for any JavaScript runtime...

CLEANSTART-2026-ZC19575 Hono is a Web application framework that provides support for any JavaScript runtime

Security vulnerability affects the n8n package. Hono is a Web application framework that provides support for any JavaScript runtime...

CLEANSTART-2026-NC98199 Security fix for GHSA-wmmp-3585-3rmp applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VQ15547 Security fix for GHSA-8m3c-c648-2xjj applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NH33763 Security fix for GHSA-2x7j-588g-ccc2 applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RK66393 multer is a middleware for handling multipart/form-data in Node

Security vulnerability affects the n8n package. multer is a middleware for handling multipart/form-data in Node...

CLEANSTART-2026-NF96877 Security fix for GHSA-cc9r-2j5m-2m83 applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VJ23809 multer is a middleware for handling multipart/form-data in Node

Security vulnerability affects the n8n package. multer is a middleware for handling multipart/form-data in Node...

CLEANSTART-2026-RE03719 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-TN18132 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-OV26495 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-IC19536 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...