2112716 matches found
CLEANSTART-2026-FK35606 undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1
Security vulnerability affects the langfuse package. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1...
CLEANSTART-2026-CL40927 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
Security vulnerability affects the langfuse package. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header...
CLEANSTART-2026-MU53391 ### Summary When `qs
Security vulnerability affects the langfuse package. Summary When qs...
CLEANSTART-2026-CJ83222 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response
Security vulnerability affects the langfuse package. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response...
CLEANSTART-2026-US73537 undici's setCookie function does not fully sanitize cookie attributes
Security vulnerability affects the langfuse package. undici's setCookie function does not fully sanitize cookie attributes...
CLEANSTART-2026-AH89272 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...
Security vulnerability affects the langfuse package. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never...
CLEANSTART-2026-MX71943 Security fix for ghsa-cc9r-2j5m-2m83 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-TL07655 Security fix for ghsa-f4xh-w4cj-qxq8 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-IF81553 undici's WebSocket client crashes the whole Node
Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...
CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...
CLEANSTART-2026-OS54288 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-EK03411 fast-uri before 4
Security vulnerability affects the langfuse package. fast-uri before 4...
CLEANSTART-2026-BZ98480 undici's experimental WebSocketStream client crashes the whole Node
Security vulnerability affects the langfuse package. undici's experimental WebSocketStream client crashes the whole Node...
CLEANSTART-2026-EW00525 Security fix for ghsa-wmmp-3585-3rmp applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-SR09955 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-UO74243 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON
Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...
CLEANSTART-2026-QL18183 Security fix for ghsa-2x7j-588g-ccc2 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-NP94260 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-FN35430 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function
Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function...
CLEANSTART-2026-OM37971 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-TF09981 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-NF20161 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-MI22504 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
CLEANSTART-2026-DI68809 memory leak in Node
Security vulnerability affects the apache-superset package. A memory leak in Node...
CLEANSTART-2026-GV36005 We have identified a bug in Node
Security vulnerability affects the apache-superset package. We have identified a bug in Node...
CLEANSTART-2026-KY64095 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-UO45080 Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities
Security vulnerability affects the apache-superset package. Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities...
CLEANSTART-2026-JO53720 incomplete fix for CVE-2024-36137 leaves `FileHandle
Security vulnerability affects the apache-superset package. An incomplete fix for CVE-2024-36137 leaves FileHandle...
CLEANSTART-2026-NZ34356 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...
CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...
CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper
Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...
CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...
CLEANSTART-2026-KU24747 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack
Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...
CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CLEANSTART-2026-DD02110 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-CJ18873 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
CLEANSTART-2026-FB75379 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
CLEANSTART-2026-JK79354 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active
Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...
CLEANSTART-2026-HS17717 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-PT41131 Out-of-bounds memory operations in org
CVE-2025-12183 affects multiple packages. Out-of-bounds memory operations in org. See references for individual vulnerability details...
CLEANSTART-2026-KE27596 js-yaml is a JavaScript YAML parser and dumper
CVE-2026-84375 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...
CLEANSTART-2026-RK84502 Security fix for ghsa-wwv5-g3v4-889x applied in: airflow-3 3.2.1-r10, airflow-3 3.3.0-r7
ghsa-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MR36651 Vitest is a testing framework powered by Vite
Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...
CLEANSTART-2026-HN56879 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
CVE-2026-64847 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...