CLEANSTART-2026-RX78395 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.20.0-r3, eks-distro-kube-scheduler 1.36.9-r2, eks-distro-kube-controller-manager-fips 1.36.8-r0, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DS55761 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-nifi-registry package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-NF19276 Improper certificate validation in Apache MINA SSHD (server-side)

Security vulnerability affects the wildfly package. Improper certificate validation in Apache MINA SSHD server-side...

CLEANSTART-2026-LA21918 TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset

CVE-2026-46604 affects multiple packages. The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. See references for individual vulnerability details...

CLEANSTART-2026-NX24657 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the rundeck package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-CI58129 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CLEANSTART-2024-PW00833 PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0

Security vulnerability affects the exiv2 package. A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0...

CLEANSTART-2023-WW67500 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2

Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...

CLEANSTART-2023-DB74273 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2

Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...

CLEANSTART-2026-LP47495 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...

CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-YO89791 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the minio-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-XM34051 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-FB75379 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns

Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...

CLEANSTART-2026-ZQ97544 path-to-regexp turns path strings into a regular expressions

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

CLEANSTART-2026-FQ89941 form-data is a library for creating readable multipart/form-data streams

Security vulnerability affects the argo-workflows package. form-data is a library for creating readable multipart/form-data streams...

CLEANSTART-2026-SP20154 ACE vulnerability in conditional configuration file processing by QOS

Security vulnerability affects the sonarqube package. ACE vulnerability in conditional configuration file processing by QOS...

CLEANSTART-2026-CT50806 proxy-addr is a Node

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

CLEANSTART-2026-IW41585 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...

CLEANSTART-2026-LK90655 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

CLEANSTART-2026-KS26010 flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Acces...

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

CLEANSTART-2026-RR86814 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-RR24550 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts

CVE-2026-86466 affects multiple packages. Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. See references for individual vulnerability details...

CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-MT48554 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-FV50118 Path-traversal vulnerability in QOS

Security vulnerability affects the apache-nifi package. Path-traversal vulnerability in QOS...

CLEANSTART-2026-IG03697 Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours)

Security vulnerability affects the keycloak package. Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours...

CLEANSTART-2026-CJ40397 flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component

Security vulnerability affects the keycloak package. A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component...

CLEANSTART-2026-ZE25949 flaw was found in the default-groups REST endpoint and realm representation of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the default-groups REST endpoint and realm representation of Keycloak...

CLEANSTART-2026-GA88793 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved

Security vulnerability affects the wildfly package. Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved...

CLEANSTART-2026-LW37073 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of serv...

Security vulnerability affects the wso2am package. There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack...

CLEANSTART-2026-KV65948 RabbitMQ amqp091-go is a Go AMQP 0

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...

CLEANSTART-2026-LO55255 Security fix for CVE-2023-45142 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, druid-exporter-fips 0.11-r0, kubernetes 1.33.13-r0

CVE-2023-45142 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BJ71317 Security fix for GHSA-wjrx-6529-hcj3 applied in: atlantis 0.37.1-r1, atlantis-fips 0.37.1-r0, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1

GHSA-wjrx-6529-hcj3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LB17279 Security fix for GHSA-4cx2-fc23-5wg6 applied in: keycloak 26.1.4-r1, kserve-modelmesh 0.12.0-r16, logstash-fips 9.0.8-r3, orientdb 3.2.38-r0

GHSA-4cx2-fc23-5wg6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WC59490 Security fix for GHSA-3wgm-2gw2-vh5m applied in: argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2

GHSA-3wgm-2gw2-vh5m affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2025-AM34484 Security fix for CVE-2025-25011 applied in: elastic-beats-fips 9.0.8-r0

Security vulnerability affects the elastic-beats-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PI41655 Security fix for CVE-2022-1996 applied in: argo-events 1.6.3-r1, cert-manager-webhook-pdns-fips 2.3.0-r0, kserve-modelmesh-serving 0.9.0-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r2

CVE-2022-1996 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZH50133 Security fix for GHSA-h8cp-697h-8c8p applied in: step-cli 0.27.5-r0, step-issuer-fips 0.9.9-r3

GHSA-h8cp-697h-8c8p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SI37771 Security fix for GHSA-jrr2-x33p-6hvc applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r5, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4

GHSA-jrr2-x33p-6hvc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG17720 Security fix for CVE-2025-47911 applied in: apache-nifi 2.10.0-r4, aws-efs-csi-driver 2.2.0-r0, aws-privateca-issuer 1.7.0-r0, aws-privateca-issuer-fips 1.7.0-r0, cadvisor 0.53.0-r0, cadvisor 0.54.1-r0, cfssl 1.5.0-r1, cosign 2.4.3-r0, cosign 2.5.3-r0, doppler-kubernetes-operator 1.7.1-r1, eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, envoy-ratelimit 0.0.0_git20251231-r0, external-dns 0.18.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r2, hubble-ui 0.13.3-r1, hubble-ui-fips 0.13.3-r1, ip-masq-agent 2.12.6-r1, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.29.0-r1, karpenter-fips 1.8.6-r0, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-state-metrics 2.10.1-r0, kube-state-metrics 2.16.0-r3, kuberay-operator 1.3.2-r3, kuberay-operator 1.4.2-r3, kuberay-operator 1.5.2-r3, kubernetes 1.33.11-r0, kubernetes 1.34.1-r2, kubernetes 1.34.7-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-event-exporter 1.7-r0, kubernetes-replicator-fips 2.12.2-r0, kured 1.20.0-r0, local-path-provisioner 0.0.36-r1, local-path-provisioner-fips 0.0.36-r1, lvm-driver 1.7.0-r0, metallb-fips 0.15.3-r0, minio-client 0.20250721.052808-r1, ollama 0.32.11-r2, openbao-fips 2.3.2-r3, openbao-fips 2.3.2-r4, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, percona-server-mongodb-operator 1.22.0-r1, policy-controller-fips 0.13.1-r0, postgres-operator 1.12.2-r2, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway-fips 1.10.0-r3, rclone 1.69.0-r0, runc 1.1.14-r0, smarter-device-manager 1.1.2-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spark-operator 2.4.0-r0, stakater-reloader 1.4.13-r0, timoni 0.25.2-r0, velero-plugin-for-aws 1.10.1-r1, velero-plugin-for-aws 1.12.2-r2, velero-plugin-for-aws-fips 1.13.2-r1, vertical-pod-autoscaler 1.5.1-r2, wave-fips 0.10.0-r1, whereabouts 0.9.2-r0, yunikorn-k8shim 1.7.0-r0

CVE-2025-47911 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD91859 Security fix for CVE-2025-48734 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips 3.7.1-r4, cassandra-reaper-fips 3.8.0-r9, stargate 1.0.90-r4, stargate 1.0.91-r1, stargate 2.0.44-r4, stargate 2.0.44-r6, strimzi-kafka-operator 0.47.0-r2

CVE-2025-48734 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AS20822 Security fix for CVE-2023-7256 applied in: calico-fips 3.31.2-r1

Security vulnerability affects the calico-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RG68334 Security fix for GHSA-jm66-cg57-jjv5 applied in: airflow-2 2.10.3-r2, az 2.81.0-r0

GHSA-jm66-cg57-jjv5 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TL78723 Security fix for CVE-2025-68156 applied in: argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, eks-distro-coredns-fips 1.35.7-r0, keda 2.17.2-r2, keda 2.18.3-r0, tempo-fips 2.7.2-r0

CVE-2025-68156 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AX22930 Security fix for CVE-2025-30204 applied in: argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, boring-registry-fips 0.15.5-r2, cosign 2.4.3-r0, cosign 2.5.3-r0, fulcio 1.5.1-r0, fulcio-fips 1.5.1-r1, fulcio-fips 1.6.6-r1, minio-operator 6.0.4-r5, minio-operator 7.0.1-r3, prometheus 2.47.2-r0, prometheus-operator 0.69.1-r0, rclone 1.69.0-r0, step-ca 0.27.5-r0, step-cli 0.27.5-r1, tempo 2.7.2-r0, tempo 2.8.3-r0, tempo-fips 2.7.2-r0, velero-plugin-for-csi 0.6.3-r1

CVE-2025-30204 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...