CLEANSTART-2026-MS81723 NumberInput

Security vulnerability affects the apache-nifi package. NumberInput...

CLEANSTART-2026-UB80318 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics 2.19.1-r3, kube-state-metrics 2.17.0-r6, kube-state-metrics 2.18.0-r9

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UW01698 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-PA97318 Security fix for GHSA-hrxh-6v49-42gf applied in: kube-state-metrics 2.19.1-r1, kube-state-metrics 2.20.0-r0, kube-state-metrics 2.18.0-r7

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FD89775 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-NE14632 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-TQ94718 Apache Airflow FAB provider versions 3

CVE-2026-75156 affects multiple packages. Apache Airflow FAB provider versions 3. See references for individual vulnerability details...

CLEANSTART-2026-OZ84157 Tornado before 6

CVE-2026-91991 affects multiple packages. Tornado before 6. See references for individual vulnerability details...

CLEANSTART-2026-NP36052 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"

Security vulnerability affects the airflow-3 package. Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"...

CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-NW83834 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-GP78521 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-MB62550 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-YX17879 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-ET86515 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-FM06572 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the cortex package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-WK22640 Caddy is an extensible server platform that uses TLS by default

Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...

CLEANSTART-2026-UL03599 Caddy is an extensible server platform that uses TLS by default

Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...

CLEANSTART-2026-QE63753 Caddy is an extensible server platform that uses TLS by default

Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...

CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap

Security vulnerability affects the apache-nifi package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...

CLEANSTART-2026-KM02072 flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows

Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows...

CLEANSTART-2026-FD75876 Keycloak provides a way to manage identity providers and organizations through its administrative API

Security vulnerability affects the keycloak package. Keycloak provides a way to manage identity providers and organizations through its administrative API...

CLEANSTART-2026-LI01273 flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows

Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows...

CLEANSTART-2026-ZF70449 flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution

Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution...

CLEANSTART-2026-AH74122 Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication

Security vulnerability affects the keycloak package. Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication...

CLEANSTART-2026-DL82237 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities

Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...

CLEANSTART-2026-SX37401 vulnerability has been found in luben zstd-jni up to 1

Security vulnerability affects the wildfly package. A vulnerability has been found in luben zstd-jni up to 1...

CLEANSTART-2026-BM99045 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-ST98100 JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates

Security vulnerability affects the wso2am package. JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates...

CLEANSTART-2026-QD76067 RabbitMQ amqp091-go is a Go AMQP 0

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...

CLEANSTART-2026-BI76968 privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration

Security vulnerability affects the vault package. A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration...

CLEANSTART-2026-FG82255 Security fix for CVE-2018-15664 applied in: docker 18.09.7-r0, docker-fips 18.09.7-r0

CVE-2018-15664 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MP51710 Security fix for CVE-2019-13509 applied in: docker 18.09.8-r0, docker-fips 18.09.8-r0

CVE-2019-13509 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TE95731 Security fix for CVE-2022-29526 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, docker 20.10.16-r0, docker-fips 20.10.16-r0, druid-exporter-fips 0.11-r0

CVE-2022-29526 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XQ25414 Security fix for CVE-2024-23653 applied in: docker 25.0.2-r0, docker-fips 25.0.2-r0

CVE-2024-23653 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XQ75557 Security fix for CVE-2024-41110 applied in: docker 26.1.5-r0, docker-fips 26.1.5-r0, kubevela 1.10.8-r0, paranoia 0.2.1-r0, prometheus 2.47.2-r1, rancher-agent 2.11.15-r1

CVE-2024-41110 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2025-XS19180 Security fix for CVE-2023-47470 applied in: ffmpeg 6.1-r0

Security vulnerability affects the ffmpeg package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DP59961 Security fix for CVE-2025-0913 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, runc 1.1.14-r0

CVE-2025-0913 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RW27001 Security fix for CVE-2022-41717 applied in: cfssl 1.5.0-r1, minio-client-fips 0.20250416181326-r0, minio-client-fips 0.20250521015954-r0, minio-client-fips 0.20250716.153503-r0, minio-client-fips 0.20250721052808-r0, wavefront-collector-for-kubernetes 1.13.0-r0

CVE-2022-41717 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GT85159 Security fix for CVE-2025-22872 applied in: cert-manager-webhook-pdns-fips 2.2.0-r0, cert-manager-webhook-pdns-fips 2.4.0-r0, cfssl 1.5.0-r1, cosign 2.4.3-r0, cosign 2.5.3-r0, ingress-nginx-controller 1.24.2-r0, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-state-metrics 2.10.1-r0, kuberay-operator 1.3.2-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, prometheus 2.55.1-r3, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway-fips 1.10.0-r3, rclone 1.69.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, wavefront-collector-for-kubernetes 1.13.0-r0

CVE-2025-22872 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZR63822 Security fix for CVE-2025-22870 applied in: cert-manager-webhook-pdns-fips 2.2.0-r0, cfssl 1.5.0-r1, clickhouse-operator 0.25.5-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-state-metrics 2.10.1-r0, kuberay-operator 1.3.2-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus 2.55.1-r3, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway-fips 1.10.0-r3, rclone 1.69.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, wavefront-collector-for-kubernetes 1.13.0-r0

CVE-2025-22870 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PO69653 Security fix for CVE-2022-46146 applied in: prometheus 2.40.4-r1, prometheus-fips 2.40.4-r1, prometheus-node-exporter 1.5.0-r0, prometheus-node-exporter-fips 1.5.0-r0

CVE-2022-46146 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SZ05253 Security fix for CVE-2025-47906 applied in: cert-manager-webhook-pdns-fips 2.2.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, harbor-registry 3.0.0.1-r2, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.6.1-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0

CVE-2025-47906 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MR52568 Security fix for CVE-2025-22871 applied in: consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, harbor-registry 3.0.0.1-r2, ingress-nginx-controller 1.24.2-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-22871 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD99087 Security fix for CVE-2025-55198 applied in: consul-k8s-fips 1.5.9-r0, harbor 2.13.4-r2, harbor 2.14.2-r1, k8sgpt 0.4.26-r2, kubevela 1.10.8-r0

CVE-2025-55198 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZE96570 Security fix for GHSA-9h84-qmv7-982p applied in: cert-manager-cmctl 2.3.0-r0, cert-manager-cmctl-fips 2.1.1-r0, cert-manager-cmctl-fips 2.3.0-r0, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, harbor 2.13.4-r2, harbor 2.14.2-r1, harbor-fips 2.10.3-r0, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, k8sgpt 0.4.26-r0, kubevela 1.10.8-r0

GHSA-9h84-qmv7-982p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HH85591 Security fix for CVE-2025-8714 applied in: postgresql16 16.10-r0, postgresql17 17.6-r0, postgresql18 17.6-r0

CVE-2025-8714 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EZ77524 Security fix for GHSA-3wgm-2mw2-vh5m applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-3wgm-2mw2-vh5m affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UI81727 Security fix for GHSA-xq3w-v528-46rv applied in: cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips 3.7.1-r4, cloudwatch-exporter 0.16.0-r0, kserve-modelmesh 0.12.0-r16, management-api-for-apache-cassandra-5.0 0.1.107-r0, management-api-for-apache-cassandra-5.0 0.1.108-r0, management-api-for-apache-cassandra-5.0 0.1.109-r0, stargate 1.0.90-r4, stargate 2.0.44-r4

GHSA-xq3w-v528-46rv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...