CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-OS54288 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-FN35430 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function

Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function...

CLEANSTART-2026-MI22504 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-PD89526 Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification

Security vulnerability affects the apache-superset package. Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification...

CLEANSTART-2026-VR96593 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-XY63591 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

CLEANSTART-2026-CJ18873 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-YC00032 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

CVE-2026-86000 affects multiple packages. Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. See references for individual vulnerability details...

CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...

CLEANSTART-2026-KE95640 JLine is a Java library for handling console input

CVE-2026-77420 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...

CLEANSTART-2026-CC86390 Security fix for GHSA-q83h-524g-xf6h applied in: ztunnel-fips 1.29.8-r0, ztunnel-fips 1.30.5-r0

GHSA-q83h-524g-xf6h affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZQ97544 path-to-regexp turns path strings into a regular expressions

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

CLEANSTART-2026-GV24243 Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

CLEANSTART-2026-QT94444 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-HE25090 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-HO72909 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-IQ33916 compression is a Node

Security vulnerability affects the argo-workflows package. compression is a Node...

CLEANSTART-2026-SB96942 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CLEANSTART-2026-YS82863 mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource con...

Security vulnerability affects the sonarqube package. A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service DoS...

CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...

CLEANSTART-2026-UP93345 vulnerability has been found in luben zstd-jni up to 1

Security vulnerability affects the kafka package. A vulnerability has been found in luben zstd-jni up to 1...

CLEANSTART-2026-CN35932 zstd-jni versions 1

Security vulnerability affects the kafka package. zstd-jni versions 1...

CLEANSTART-2026-UX53854 zstd-jni versions 1

Security vulnerability affects the kafka package. zstd-jni versions 1...

CLEANSTART-2026-HU83595 client may issue specially crafted HTTP/1

Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-DB50494 vulnerability occurs when a client sends HTTP/1

Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...

CLEANSTART-2026-CK84592 Uncontrolled Recursion vulnerability in Apache Commons Lang

Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

CLEANSTART-2026-US79386 Security fix for GHSA-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...

CLEANSTART-2026-FO79285 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the loki package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-FW47694 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-MS81723 NumberInput

Security vulnerability affects the apache-nifi package. NumberInput...

CLEANSTART-2026-UB80318 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics 2.19.1-r3, kube-state-metrics 2.17.0-r6, kube-state-metrics 2.18.0-r9

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UW01698 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-FD89775 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-TQ94718 Apache Airflow FAB provider versions 3

CVE-2026-75156 affects multiple packages. Apache Airflow FAB provider versions 3. See references for individual vulnerability details...

CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-NW83834 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...