CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...

CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-ZP53409 attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing

Security vulnerability affects the cri-tools package. An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing...

CLEANSTART-2026-PL94535 On Unix platforms, when listing the contents of a directory using File

Security vulnerability affects the cri-tools package. On Unix platforms, when listing the contents of a directory using File...

CLEANSTART-2026-MW22726 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the cri-tools package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CLEANSTART-2026-DU09908 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

Security vulnerability affects the docker-cli-buildx package. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner...

CLEANSTART-2026-OE45196 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...

Security vulnerability affects the docker-cli-buildx package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory...

CLEANSTART-2024-BH94102 flaw was found in samba's Heimdal KDC implementation, versions 4

Security vulnerability affects the heimdal package. A flaw was found in samba's Heimdal KDC implementation, versions 4...

CLEANSTART-2024-IW99789 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Security vulnerability affects the nghttp2 package. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service...

CLEANSTART-2026-CS99408 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-LP47495 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1

Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...

CLEANSTART-2026-XE09130 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...

Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...

CLEANSTART-2026-TV66074 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the kube-state-metrics-fips package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-TX77163 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the kube-state-metrics-fips package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-HN45424 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the kube-state-metrics-fips package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

CLEANSTART-2026-PF53070 On Unix platforms, when listing the contents of a directory using File

CVE-2026-27139 affects multiple packages. On Unix platforms, when listing the contents of a directory using File. See references for individual vulnerability details...

CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2024-XJ51471 flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers

Security vulnerability affects the buildah package. A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers...

CLEANSTART-2023-XN05686 egg-compile

Security vulnerability affects the chicken package. egg-compile...

CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-TI91814 undici's retry handler can leave an already-exposed response body pending forever

Security vulnerability affects the langfuse package. undici's retry handler can leave an already-exposed response body pending forever...

CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-MI22504 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

CLEANSTART-2026-EI91095 Security fix for GHSA-78h2-9frx-2jm8 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...

CLEANSTART-2026-WC95670 nanoid (Nano ID) before 3

Security vulnerability affects the qdrant package. nanoid Nano ID before 3...

CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript

Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...

CLEANSTART-2026-YY11796 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-YX84195 pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

CVE-2026-66274 affects multiple packages. A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-JV92221 authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service

CVE-2026-66276 affects multiple packages. An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-AL73661 Security fix for CVE-2023-28842 applied in: docker 23.0.3-r0, docker-fips 23.0.3-r0, paranoia 0.2.1-r0

CVE-2023-28842 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NQ97592 Security fix for CVE-2020-14147 applied in: redis 6.0.3-r0

Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XS03344 Security fix for CVE-2022-31144 applied in: redis 7.0.4-r0

Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EE78869 Security fix for CVE-2022-24834 applied in: redis 7.0.12-r0

Security vulnerability affects the redis package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IV22792 Security fix for GHSA-6v2p-p543-phr9 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0, argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, argo-events 1.6.3-r1, argo-workflows-fips 3.4.18-r0, calico-fips 3.28.5-r2, calico-fips 3.29.5-r0, clickhouse-operator 0.25.5-r0, cortex-fips 0, cosign 2.4.3-r0, cosign 2.5.3-r0, dynamic-localpv-provisioner 4.4.0-r0, falcoctl 0.11.0-r0, fluent-operator-fips 3.1.0-r4, fluent-operator-fips 3.2.0-r0, helm-fips 3.17-4-r1, k8sgpt 0.4.26-r0, kapp-controller 0.59.0-r0, kapp-controller-fips 0.59.0-r0, kor 0.3.8-r0, kor 0.4.2-r0, kor 0.5.9-r0, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-vip-fips 0.7.2-r0, kube-vip-fips 0.8.10-r0, kubernetes 1.31.13-r0, kubernetes 1.31.14-r0, kubernetes 1.32.10-r0, kubernetes 1.32.9-r0, kubernetes-fips 1.31.13-r0, kubernetes-fips 1.32.11-r0, kubernetes-fips 1.32.9-r0, kyverno-fips 1.13.6-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r6, litestream 0.5.2-r0, litestream 0.5.2-r1, local-static-provisioner 2.8.0-r0, metallb 0.14.9-r3, metrics-server-fips 0.7.2-r1, minio-operator 7.0.1-r5, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, multus-cni-fips 3.9.3-r2, multus-cni-fips 4.0.2-r2, nfs-subdir-external-provisioner-fips 4.0.17-r0, nfs-subdir-external-provisioner-fips 4.0.18-r1, node-problem-detector 0.8.19-r0, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1, postgres-operator 1.12.2-r2, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.6.1-r0, prometheus-node-exporter-fips 1.7.0-r0, prometheus-node-exporter-fips 1.8.2-r0, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, stakater-reloader 1.1.0-r0, tempo-fips 2.7.2-r0, tigera-operator-fips 1.37.2-r0, trust-manager-fips 0.16.0-r0, vault-k8s 1.4.2-r1, vault-k8s 1.5.0-r1, vault-k8s-fips 1.4.2-r0, vault-k8s-fips 1.5.0-r0, wave-fips 0.10.0-r0, wave-fips 0.7.2-r1, wave-fips 0.8.0-r1, wave-fips 0.9.0-r1, wavefront-collector-for-kubernetes 1.13.0-r0

GHSA-6v2p-p543-phr9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QA69007 Security fix for GHSA-qxp5-gwg8-xv66 applied in: cfssl 1.5.0-r1, clickhouse-operator 0.25.5-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dynamic-localpv-provisioner 4.4.0-r0, falcoctl 0.11.0-r0, go-fips-1.24 1.24.7-r0, go1.24 1.24.11-r0, harbor-registry 3.0.0.1-r2, kserve-modelmesh-serving 0.12.0-r1, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-fips 1.31.13-r0, kubernetes-fips 1.32.11-r0, kubernetes-fips 1.32.9-r0, kyverno-fips 1.13.6-r1, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, multus-cni-fips 4.0.2-r2, opentofu-fips 1.9.4-r0, prometheus-node-exporter 1.8.0-r3, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, vault-k8s-fips 1.7.0-r0, wave-fips 0.7.2-r1, wave-fips 0.8.0-r1, wave-fips 0.9.0-r1, wavefront-collector-for-kubernetes 1.13.0-r0

GHSA-qxp5-gwg8-xv66 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TQ69146 Security fix for GHSA-m5vv-6r4h-3vj9 applied in: kyverno-fips 1.12.7-r0, lvm-driver 1.8.1-r2, modelmesh-runtime-adapter 0.12.0-r3, velero-fips 1.13.2-r0

GHSA-m5vv-6r4h-3vj9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XR94463 Security fix for CVE-2025-55199 applied in: consul-k8s-fips 1.5.9-r0, harbor 2.13.4-r2, harbor 2.14.2-r1, k8sgpt 0.4.26-r2, kubevela 1.10.8-r0

CVE-2025-55199 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EM35867 Security fix for GHSA-c6gw-w398-hv78 applied in: argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, cosign 2.4.3-r0, cosign 2.5.3-r0, falcoctl 0.11.0-r0, harbor-fips 2.10.3-r0, kyverno-fips 1.13.6-r1, kyverno-fips 1.13.6-r10, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4, opentofu-fips 1.9.4-r0, rabbitmq-messaging-topology-operator 1.15.0-r1, step-cli 0.27.5-r0

GHSA-c6gw-w398-hv78 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VE93341 Security fix for GHSA-fv92-fjc5-jj9h applied in: argo-workflows 3.6.16-r0, fulcio 1.7.1-r0, fulcio-fips 1.7.1-r1, kyverno-fips 1.13.6-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4, opentofu-fips 1.10.7-r0, opentofu-fips 1.10.7-r1, tempo 2.7.2-r0, tempo 2.8.3-r0, tempo-fips 2.7.2-r0

GHSA-fv92-fjc5-jj9h affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...