CLEANSTART-2026-WP20592 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Multiple security vulnerabilities affect the argo-workflows-fips package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability...

CLEANSTART-2026-WQ07901 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the argo-cd-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-SV79070 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the cloudnative-pg-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-ME47927 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Multiple security vulnerabilities affect the consul-k8s-fips package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details...

CLEANSTART-2026-CT39828 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Multiple security vulnerabilities affect the chartmuseum-fips package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details...

CLEANSTART-2026-RD08428 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the helm-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-IL25782 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the istio-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-IW06531 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-DD39330 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the multus-cni-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-MI26039 Within HostnameError

Multiple security vulnerabilities affect the step-issuer package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-EZ98723 Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a ...

Multiple security vulnerabilities affect the ffmpeg package. Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service DoS via the...

CLEANSTART-2026-NJ87139 vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device

Multiple security vulnerabilities affect the clamav package. A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. See references for individual vulnerability details...

CLEANSTART-2026-HO68117 vm2 before 3

Security vulnerability affects the n8n package. vm2 before 3...

CLEANSTART-2026-WP99791 zstd-jni versions 1

CVE-2026-89045 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...

CLEANSTART-2026-QQ38336 Due to an incomplete fix to CVE-2022-31629 https://github

Security vulnerability affects the php package. Due to an incomplete fix to CVE-2022-31629 https://github...

CLEANSTART-2026-EL93151 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the minio-operator package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-KA42623 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Security vulnerability affects the airflow-3 package. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio...

CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-FC13167 aiosmtplib before 5

CVE-2026-90467 affects multiple packages. aiosmtplib before 5. See references for individual vulnerability details...

CLEANSTART-2026-FC44731 Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation

CVE-2026-82310 affects multiple packages. Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. See references for individual vulnerability details...

CLEANSTART-2026-BT23660 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-QJ88718 flaw was found in the keycloak-services component of Red Hat Build of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Red Hat Build of Keycloak...

CLEANSTART-2026-KJ02957 pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

CVE-2026-66257 affects multiple packages. A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-KU86839 RabbitMQ amqp091-go is a Go AMQP 0

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...

CLEANSTART-2026-LC07021 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority

Security vulnerability affects the vault package. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CLEANSTART-2026-YH81834 Security fix for CVE-2024-45341 applied in: flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0

CVE-2024-45341 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GK32867 Security fix for CVE-2026-1703 applied in: k8s-sidecar 1.25.2-r0, kubernetes-csi-driver-nfs-fips 4.13.0-r0, python3 3.11.14-r0, python3 3.12.12-r0

CVE-2026-1703 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MW19809 Security fix for CVE-2026-22735 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r0, apache-nifi 2.6.0-r3, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, thingsboard 4.3.0.1-r2

CVE-2026-22735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QF32596 Security fix for GHSA-xw73-rw38-6vjc applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4, paranoia 0.2.1-r0

GHSA-xw73-rw38-6vjc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AI37690 Security fix for CVE-2026-59277 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GE74044 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. S...

CLEANSTART-2026-ED42524 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

Multiple security vulnerabilities affect the spring-boot package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. See references for...

CLEANSTART-2026-DB46993 Prometheus is an open-source monitoring system and time series database

Multiple security vulnerabilities affect the prometheus-operator package. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-BY91066 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the dynatrace-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CLEANSTART-2026-FR63847 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-DC71490 Security fixes in keda 2.20.2-r1

Package keda version 2.20.2-r1 fixes 1 vulnerabilities: ghsa-gcjh-h69q-9w9g...

CLEANSTART-2026-WM58118 Security fixes in rancher-agent 2.13.7-r3

Package rancher-agent version 2.13.7-r3 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-CY42435 Security fixes in amazon-cloudwatch-agent 1.300071.0-r1

Package amazon-cloudwatch-agent version 1.300071.0-r1 fixes 36 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-FI83495 Security fixes in ollama 0.32.0-r1

Package ollama version 0.32.0-r1 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-PJ87430 Security fixes in rabbitmq-messaging-topology-operator 1.2.1-r1

Package rabbitmq-messaging-topology-operator version 1.2.1-r1 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-XH81643 Security fixes in opa-fips 1.19.1-r2

Package opa-fips version 1.19.1-r2 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-CD03295 Security fixes in rancher-agent 2.11.15-r1

Package rancher-agent version 2.11.15-r1 fixes 28 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-53489, CVE-2024-40635, CVE-2024-25621...

CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0

Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-XO42004 Security fixes in eck-operator 3.4.1-r3

Package eck-operator version 3.4.1-r3 fixes 1 vulnerabilities: CVE-2026-56852...

CLEANSTART-2026-WX98343 Security fixes in grafana 12.4.6-r0

Package grafana version 12.4.6-r0 fixes 4 vulnerabilities: ghsa-jpcw-4wr7-c3vq, ghsa-r277-6w6q-xmqw, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...

CLEANSTART-2026-RD68609 Security fixes in tigera-operator-fips 1.40.13-r1

Package tigera-operator-fips version 1.40.13-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-EL49045 Security fixes in velero-plugin-for-gcp-fips 1.14.2-r1

Package velero-plugin-for-gcp-fips version 1.14.2-r1 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-PV97699 Security fixes in tekton-pipelines-fips 1.14.0-r2

Package tekton-pipelines-fips version 1.14.0-r2 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-GL72878 Security fixes in prometheus 3.13.1-r1

Package prometheus version 3.13.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-SK52724 Security fixes in cosign 3.1.2-r1

Package cosign version 3.1.2-r1 fixes 9 vulnerabilities: CVE-2026-54787, ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-49835, ghsa-9c54-x2g4-v92j...