CLEANSTART-2026-IF81553 undici's WebSocket client crashes the whole Node

Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...

CLEANSTART-2026-OS54288 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...

CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-QL18183 Security fix for ghsa-2x7j-588g-ccc2 applied in: langfuse 3.225.9-r1

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OM37971 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-TF09981 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-GV36005 We have identified a bug in Node

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

CLEANSTART-2026-JO53720 incomplete fix for CVE-2024-36137 leaves `FileHandle

Security vulnerability affects the apache-superset package. An incomplete fix for CVE-2024-36137 leaves FileHandle...

CLEANSTART-2026-NZ34356 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-DD02110 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-FB75379 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns

Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-HS17717 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-RK84502 Security fix for ghsa-wwv5-g3v4-889x applied in: airflow-3 3.2.1-r10, airflow-3 3.3.0-r7

ghsa-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-KE95640 JLine is a Java library for handling console input

CVE-2026-77420 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...

CLEANSTART-2026-SC57620 Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1

Security vulnerability affects the elasticsearch package. Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1...

CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...

CLEANSTART-2026-PP78809 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-SR26981 Security fix for ghsa-r7wm-3cxj-wff9 applied in: spark-sc212-jdk17-py311 3.4.4-r1, sonarqube 26.7.0.124771-r4

ghsa-r7wm-3cxj-wff9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HR33397 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...

CLEANSTART-2026-RI59147 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-QT94444 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-TI66876 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

CVE-2026-71290 affects multiple packages. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

CLEANSTART-2026-EW82020 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-TK63612 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-TC19011 Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (

Security vulnerability affects the argo-workflows package. Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period...

CLEANSTART-2026-NK73842 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...

CLEANSTART-2026-FU60890 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates

Security vulnerability affects the argo-workflows package. moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates...

CLEANSTART-2026-JH16561 Improper certificate validation in Apache MINA SSHD (server-side)

Security vulnerability affects the sonarqube package. Improper certificate validation in Apache MINA SSHD server-side...

CLEANSTART-2026-QN59512 In Bouncy Castle for Java before 1

CVE-2026-58061 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CLEANSTART-2026-QG94789 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-KL34343 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...

CLEANSTART-2026-IH43299 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-ES07663 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-PL58234 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-CG97274 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-KU83313 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-TZ09110 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-MV24279 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54515 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-UC28835 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-EW49412 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Security vulnerability affects the argo-workflows package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CLEANSTART-2026-GT01967 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...

CLEANSTART-2026-TR21269 Netty is a network application framework for development of protocol servers and clients

CVE-2026-45536 affects multiple packages. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...