11796 matches found
CLEANSTART-2024-LR52938 libavcodec/dnxhddec
Security vulnerability affects the ffmpeg4 package. libavcodec/dnxhddec...
CLEANSTART-2023-YY56914 invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec
Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbrdec...
CLEANSTART-2023-NE75380 issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2
Security vulnerability affects the faad2 package. An issue was discovered in Freeware Advanced Audio Decoder 2 FAAD2 2...
CLEANSTART-2023-NX33321 There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj
Security vulnerability affects the faad2 package. There is a stack-based buffer underflow in the third instance of the calculategain function in libfaad/sbrhfadj...
CLEANSTART-2023-TC91204 NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in ifilterbank of libfaad/filtbank...
CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...
CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...
CLEANSTART-2024-KG85356 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript
Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...
CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CLEANSTART-2026-PL94535 On Unix platforms, when listing the contents of a directory using File
Security vulnerability affects the cri-tools package. On Unix platforms, when listing the contents of a directory using File...
CLEANSTART-2026-DU09908 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner
Security vulnerability affects the docker-cli-buildx package. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner...
CLEANSTART-2026-OE45196 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...
Security vulnerability affects the docker-cli-buildx package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory...
CLEANSTART-2024-OD86351 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by ...
Security vulnerability affects the dnsdist package. When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IX...
CLEANSTART-2024-BH94102 flaw was found in samba's Heimdal KDC implementation, versions 4
Security vulnerability affects the heimdal package. A flaw was found in samba's Heimdal KDC implementation, versions 4...
CLEANSTART-2024-AC14298 PAC parsing in MIT Kerberos 5 (aka krb5) before 1
CVE-2022-42898 affects multiple packages. PAC parsing in MIT Kerberos 5 aka krb5 before 1. See references for individual vulnerability details...
CLEANSTART-2024-ND97566 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023
Security vulnerability affects the nghttp2 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-CS99408 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...
CLEANSTART-2026-XE09130 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...
Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...
CLEANSTART-2026-TV66074 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
Security vulnerability affects the kube-state-metrics-fips package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...
CLEANSTART-2026-UN16903 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly
Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...
CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service
Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...
CLEANSTART-2024-EN97769 Endless Infinite loop in Blender-thumnailing due to logical bugs
Security vulnerability affects the blender package. Endless Infinite loop in Blender-thumnailing due to logical bugs...
CLEANSTART-2026-DP89465 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used
Security vulnerability affects the minio-operator package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...
CLEANSTART-2026-GN07707 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the minio-operator package. Previously, resolving relative paths containing parent directory '...
CLEANSTART-2026-DE66798 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the minio-operator package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-WR14423 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the langfuse package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...
CLEANSTART-2026-AH89272 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...
Security vulnerability affects the langfuse package. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never...
CLEANSTART-2026-TI91814 undici's retry handler can leave an already-exposed response body pending forever
Security vulnerability affects the langfuse package. undici's retry handler can leave an already-exposed response body pending forever...
CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...
CLEANSTART-2026-UO74243 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...
CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-MI22504 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...
CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name
Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library
CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...
CLEANSTART-2026-CC86390 Security fix for GHSA-q83h-524g-xf6h applied in: ztunnel-fips 1.29.8-r0, ztunnel-fips 1.30.5-r0
GHSA-q83h-524g-xf6h affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-GA82552 Babel is a compiler for writing next generation JavaScript
Security vulnerability affects the argo-workflows package. Babel is a compiler for writing next generation JavaScript...
CLEANSTART-2026-TI30417 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-KQ19093 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-JH16561 Improper certificate validation in Apache MINA SSHD (server-side)
Security vulnerability affects the sonarqube package. Improper certificate validation in Apache MINA SSHD server-side...
CLEANSTART-2026-ZD25071 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations
Security vulnerability affects the argo-workflows package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...
CLEANSTART-2026-SB96942 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-QD39247 zstd-jni versions 1
Security vulnerability affects the kafka package. zstd-jni versions 1...
CLEANSTART-2026-MY24201 pgx is a PostgreSQL driver and toolkit for Go
Security vulnerability affects the grafana-alloy package. pgx is a PostgreSQL driver and toolkit for Go...
CLEANSTART-2026-DB50494 vulnerability occurs when a client sends HTTP/1
Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...
CLEANSTART-2026-US79386 Security fix for GHSA-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...