11796 matches found
CLEANSTART-2026-CI58129 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CLEANSTART-2024-KP03061 Use after free in Extensions API in Google Chrome prior to 92
Security vulnerability affects the chromium package. Use after free in Extensions API in Google Chrome prior to 92...
CLEANSTART-2024-XU01734 decode_frame in libavcodec/exr
Security vulnerability affects the ffmpeg4 package. decodeframe in libavcodec/exr...
CLEANSTART-2024-LR52938 libavcodec/dnxhddec
Security vulnerability affects the ffmpeg4 package. libavcodec/dnxhddec...
CLEANSTART-2023-YY56914 invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec
Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbrdec...
CLEANSTART-2023-TC91204 NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in ifilterbank of libfaad/filtbank...
CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...
CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...
CLEANSTART-2024-KG85356 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript
Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...
CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-EI89098 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CLEANSTART-2026-PL94535 On Unix platforms, when listing the contents of a directory using File
Security vulnerability affects the cri-tools package. On Unix platforms, when listing the contents of a directory using File...
CLEANSTART-2026-DU09908 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner
Security vulnerability affects the docker-cli-buildx package. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner...
CLEANSTART-2026-OE45196 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...
Security vulnerability affects the docker-cli-buildx package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory...
CLEANSTART-2024-OD86351 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by ...
Security vulnerability affects the dnsdist package. When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IX...
CLEANSTART-2024-BH94102 flaw was found in samba's Heimdal KDC implementation, versions 4
Security vulnerability affects the heimdal package. A flaw was found in samba's Heimdal KDC implementation, versions 4...
CLEANSTART-2026-CS99408 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...
CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-XE09130 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...
Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...
CLEANSTART-2026-TV66074 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
Security vulnerability affects the kube-state-metrics-fips package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...
CLEANSTART-2026-UN16903 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly
Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...
CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service
Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...
CLEANSTART-2024-EN97769 Endless Infinite loop in Blender-thumnailing due to logical bugs
Security vulnerability affects the blender package. Endless Infinite loop in Blender-thumnailing due to logical bugs...
CLEANSTART-2026-AI91182 tar
Security vulnerability affects the minio-operator package. tar...
CLEANSTART-2026-GN07707 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the minio-operator package. Previously, resolving relative paths containing parent directory '...
CLEANSTART-2026-WR14423 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the langfuse package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...
CLEANSTART-2026-TI91814 undici's retry handler can leave an already-exposed response body pending forever
Security vulnerability affects the langfuse package. undici's retry handler can leave an already-exposed response body pending forever...
CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...
CLEANSTART-2026-UO74243 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-MI22504 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...
CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name
Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
CLEANSTART-2026-YN41310 PAC4J is vulnerable to LDAP Injection in multiple methods
Security vulnerability affects the apache-hive package. PAC4J is vulnerable to LDAP Injection in multiple methods...
CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library
CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...
CLEANSTART-2026-CC86390 Security fix for GHSA-q83h-524g-xf6h applied in: ztunnel-fips 1.29.8-r0, ztunnel-fips 1.30.5-r0
GHSA-q83h-524g-xf6h affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-TI30417 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-KQ19093 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-JH16561 Improper certificate validation in Apache MINA SSHD (server-side)
Security vulnerability affects the sonarqube package. Improper certificate validation in Apache MINA SSHD server-side...
CLEANSTART-2026-VJ64533 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...
CLEANSTART-2026-ZD25071 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations
Security vulnerability affects the argo-workflows package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...
CLEANSTART-2026-SB96942 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-MY24201 pgx is a PostgreSQL driver and toolkit for Go
Security vulnerability affects the grafana-alloy package. pgx is a PostgreSQL driver and toolkit for Go...
CLEANSTART-2026-XW68310 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages
Security vulnerability affects the grafana-alloy package. OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages...
CLEANSTART-2026-DB50494 vulnerability occurs when a client sends HTTP/1
Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...
CLEANSTART-2026-UC45945 Security fix for GHSA-rjr7-jggh-pgcp applied in: step-ca 0.28.4-r5
Security vulnerability affects the step-ca package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-US79386 Security fix for GHSA-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-SR68419 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh
Security vulnerability affects the loki package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...