CLEANSTART-2026-IR34711 JLine is a Java library for handling console input

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

CLEANSTART-2026-QX36211 JLine is a Java library for handling console input

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

CLEANSTART-2026-IA44862 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-SB52604 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

CLEANSTART-2026-PV37288 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...

CLEANSTART-2026-KZ87014 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-JU97425 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-IW75914 UTF8DataInputJsonParser

CVE-2026-89425 affects multiple packages. UTF8DataInputJsonParser. See references for individual vulnerability details...

CLEANSTART-2026-AT75001 TypeDeserializerBase

CVE-2026-91776 affects multiple packages. TypeDeserializerBase. See references for individual vulnerability details...

CLEANSTART-2026-ZC88513 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-ON24571 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-MR26422 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...

CLEANSTART-2026-OI83794 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-FK40139 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-WN99328 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-CF02971 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the argo-cd package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CLEANSTART-2026-UR89459 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the argo-cd package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-RY75386 Mako is a template library written in Python

CVE-2026-102991 affects multiple packages. Mako is a template library written in Python. See references for individual vulnerability details...

CLEANSTART-2026-BK97819 urllib3 is an HTTP client library for Python

CVE-2026-97688 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-DV56251 urllib3 is an HTTP client library for Python

CVE-2026-97687 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-IZ97021 Werkzeug is a comprehensive WSGI web application library

CVE-2026-102598 affects multiple packages. Werkzeug is a comprehensive WSGI web application library. See references for individual vulnerability details...

CLEANSTART-2026-IM25560 Security fix for GHSA-3hv7-mjh2-fv65 applied in: airflow-3 3.1.8-r13, airflow-3 3.2.1-r11, airflow-3 3.0.6-r9

GHSA-3hv7-mjh2-fv65 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EH65259 urllib3 is an HTTP client library for Python

CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-IF03727 Security fix for GHSA-chx6-46f5-w4vp applied in: airflow-3 3.1.8-r13, airflow-3 3.2.1-r11, airflow-3 3.0.6-r9

GHSA-chx6-46f5-w4vp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YE37392 Security fix for GHSA-c2m8-h5v5-343r applied in: airflow-3 3.1.8-r13, airflow-3 3.2.1-r11, airflow-3 3.0.6-r9

GHSA-c2m8-h5v5-343r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FR34222 Security fix for GHSA-wwv5-g3v4-889x applied in: jupyterhub-k8s-hub 6.0.0-r1

Security vulnerability affects the jupyterhub-k8s-hub package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PJ73152 Security fix for GHSA-8423-8fgw-73vq applied in: jupyterhub-k8s-hub 6.0.0-r1

Security vulnerability affects the jupyterhub-k8s-hub package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WT65883 bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep

Security vulnerability affects the airflow-3 package. A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep...

CLEANSTART-2026-TZ94047 Tornado is a Python web framework and asynchronous networking library

Security vulnerability affects the jupyterhub-k8s-hub package. Tornado is a Python web framework and asynchronous networking library...

CLEANSTART-2026-DF84636 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

CVE-2026-59295 affects multiple packages. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. See references for individual vulnerability details...

CLEANSTART-2026-PK02835 Vim is an open source, command line text editor

Security vulnerability affects the keycloak package. Vim is an open source, command line text editor...

CLEANSTART-2026-GB94492 Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform

CVE-2026-59296 affects multiple packages. Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. See references for individual vulnerability details...

CLEANSTART-2026-JW77744 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

CLEANSTART-2026-HN65934 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

CLEANSTART-2026-WK92000 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

CLEANSTART-2026-VJ66096 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-NB81003 Security fix for GHSA-r7wm-3cxj-wff9 applied in: apache-nifi 2.5.0-r0

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-HU10682 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite

Security vulnerability affects the apache-nifi package. Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite...

CLEANSTART-2026-GJ69600 Apache NiFi 0

Security vulnerability affects the apache-nifi package. Apache NiFi 0...

CLEANSTART-2026-FF85113 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-SG81759 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-QK55456 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-OB90229 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-AE51081 Uncontrolled Resource Consumption vulnerability in the HTTP/1

Security vulnerability affects the apache-nifi package. Uncontrolled Resource Consumption vulnerability in the HTTP/1...

CLEANSTART-2026-RP24117 ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java

Security vulnerability affects the apache-nifi package. ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java...

CLEANSTART-2026-DC64340 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-SC69074 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-VC78529 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...

CLEANSTART-2026-DX76026 SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X

Security vulnerability affects the apache-nifi package. SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X...

CLEANSTART-2026-DP19195 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...