11796 matches found
CLEANSTART-2026-UM59263 snappy-java through 1
Security vulnerability affects the solr package. snappy-java through 1...
CLEANSTART-2026-WE83392 urllib3 is an HTTP client library for Python
Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...
CLEANSTART-2026-GB44071 toml-node is a TOML parser for Node
Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...
CLEANSTART-2026-RL65509 vm2 is a sandbox for running untrusted Node
Security vulnerability affects the n8n package. vm2 is a sandbox for running untrusted Node...
CLEANSTART-2026-ZC70101 vm2 before 3
Security vulnerability affects the n8n package. vm2 before 3...
CLEANSTART-2026-LI48838 vm2 before 3
Security vulnerability affects the n8n package. vm2 before 3...
CLEANSTART-2026-DN17420 vm2 before 3
Security vulnerability affects the n8n package. vm2 before 3...
CLEANSTART-2026-CF02971 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
Security vulnerability affects the argo-cd package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...
CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CLEANSTART-2026-ZP32525 flaw was found in a change made to path normalization in Apache HTTP Server 2
Security vulnerability affects the apache2 package. A flaw was found in a change made to path normalization in Apache HTTP Server 2...
CLEANSTART-2026-FI29300 Connect2id Nimbus JOSE + JWT 10
Security vulnerability affects the apache-hive package. Connect2id Nimbus JOSE + JWT 10...
CLEANSTART-2026-CO70761 In Connect2id Nimbus JOSE+JWT before 9
Security vulnerability affects the apache-hive package. In Connect2id Nimbus JOSE+JWT before 9...
CLEANSTART-2026-GA95827 Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor
Security vulnerability affects the apache-hive package. Jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor...
CLEANSTART-2026-JU40621 attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container
Security vulnerability affects the apache-hive package. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container...
CLEANSTART-2026-AS77854 Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)
Security vulnerability affects the apache-hive package. The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression...
CLEANSTART-2026-KG46723 When returning errors, functions in the net/textproto package would include its input as part of the error
CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...
CLEANSTART-2026-AA31447 Several components in Spring Security compare security-sensitive values using standard string equality (String
Security vulnerability affects the apache-nifi-registry package. Several components in Spring Security compare security-sensitive values using standard string equality String...
CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute
Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...
CLEANSTART-2026-FB52227 flaw was found in Netty's HttpServerCodec
Security vulnerability affects the elasticsearch package. A flaw was found in Netty's HttpServerCodec...
CLEANSTART-2026-VX91878 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read
Security vulnerability affects the external-dns package. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...
CLEANSTART-2026-BB15937 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...
CLEANSTART-2026-RD95849 TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption
CVE-2026-46602 affects multiple packages. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. See references for individual vulnerability details...
CLEANSTART-2026-JM28284 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
Security vulnerability affects the spark package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...
CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON
Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...
CLEANSTART-2026-FP29744 Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`
Security vulnerability affects the sonarqube package. Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri...
CLEANSTART-2026-VD99251 flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input
Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input...
CLEANSTART-2026-XT16211 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)
Security vulnerability affects the sonarqube package. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33...
CLEANSTART-2026-CF09659 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)
Security vulnerability affects the sonarqube package. Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586...
CLEANSTART-2026-ZF54924 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...
CLEANSTART-2026-OX02272 Security fix for GHSA-259r-337f-4rfw applied in: dex-fips 2.42.1-r5, nfs-subdir-external-provisioner 4.0.2-r2, temporal-server 1.31.3-r2
GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MM79132 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Security vulnerability affects the temporal-server package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...
CLEANSTART-2026-IY13000 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-CI58129 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CLEANSTART-2024-KP03061 Use after free in Extensions API in Google Chrome prior to 92
Security vulnerability affects the chromium package. Use after free in Extensions API in Google Chrome prior to 92...
CLEANSTART-2024-XU01734 decode_frame in libavcodec/exr
Security vulnerability affects the ffmpeg4 package. decodeframe in libavcodec/exr...
CLEANSTART-2024-LR52938 libavcodec/dnxhddec
Security vulnerability affects the ffmpeg4 package. libavcodec/dnxhddec...
CLEANSTART-2023-YY56914 invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec
Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbrdec...
CLEANSTART-2023-TC91204 NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in ifilterbank of libfaad/filtbank...
CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...
CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...
CLEANSTART-2024-KG85356 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript
Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...
CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CLEANSTART-2026-PL94535 On Unix platforms, when listing the contents of a directory using File
Security vulnerability affects the cri-tools package. On Unix platforms, when listing the contents of a directory using File...
CLEANSTART-2026-DU09908 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner
Security vulnerability affects the docker-cli-buildx package. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner...
CLEANSTART-2026-OE45196 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...
Security vulnerability affects the docker-cli-buildx package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory...
CLEANSTART-2024-OD86351 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by ...
Security vulnerability affects the dnsdist package. When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IX...
CLEANSTART-2024-BH94102 flaw was found in samba's Heimdal KDC implementation, versions 4
Security vulnerability affects the heimdal package. A flaw was found in samba's Heimdal KDC implementation, versions 4...
CLEANSTART-2024-AC14298 PAC parsing in MIT Kerberos 5 (aka krb5) before 1
CVE-2022-42898 affects multiple packages. PAC parsing in MIT Kerberos 5 aka krb5 before 1. See references for individual vulnerability details...