11796 matches found
CLEANSTART-2026-CK85673 undici's WebSocket client crashes the whole Node
CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...
CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-PE22489 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...
Security vulnerability affects the apache-nifi-registry package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent...
CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute
Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...
CLEANSTART-2026-LX98004 zstd-jni versions 1
CVE-2026-89046 affects multiple packages. zstd-jni versions 1. See references for individual vulnerability details...
CLEANSTART-2026-KY37458 RSA and DSA public key parsers did not enforce size limits on key parameters
CVE-2026-39829 affects multiple packages. The RSA and DSA public key parsers did not enforce size limits on key parameters. See references for individual vulnerability details...
CLEANSTART-2026-ED93010 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
Security vulnerability affects the wso2mi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...
CLEANSTART-2026-JS37598 security flaw has been discovered in mwiede jsch up to 2
Security vulnerability affects the wso2mi package. A security flaw has been discovered in mwiede jsch up to 2...
CLEANSTART-2026-FS24569 Socket Appender in Apache Log4j Core versions 2
Security vulnerability affects the sonarqube package. The Socket Appender in Apache Log4j Core versions 2...
CLEANSTART-2026-IB65674 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)
Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...
CLEANSTART-2026-ZU18134 Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)
Security vulnerability affects the sonarqube package. Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...
CLEANSTART-2026-YW89455 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-IL95812 urllib3 is an HTTP client library for Python
CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-EN30370 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh
CVE-2026-39831 affects multiple packages. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh. See references for individual vulnerability details...
CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...
CLEANSTART-2026-MM79132 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Security vulnerability affects the temporal-server package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...
CLEANSTART-2026-PF50810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
Security vulnerability affects the temporal-server package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...
CLEANSTART-2026-KT14793 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the temporal-server package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
CLEANSTART-2026-LG62775 (*x509
Security vulnerability affects the temporal-server package. x509...
CLEANSTART-2026-TG48757 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash
Security vulnerability affects the temporal-server package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...
CLEANSTART-2026-UP16119 Security fix for GHSA-cg3q-j54f-5p7p applied in: nfs-subdir-external-provisioner 4.0.2-r0
Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-DH14395 net/url package does not set a limit on the number of query parameters in a query
Security vulnerability affects the go1.27 package. The net/url package does not set a limit on the number of query parameters in a query...
CLEANSTART-2026-NS20833 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened
Security vulnerability affects the go1.27 package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...
CLEANSTART-2026-ZJ64953 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
Security vulnerability affects the prometheus-redis-exporter-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...
CLEANSTART-2026-PD83002 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption
Security vulnerability affects the prometheus-redis-exporter-fips package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...
CLEANSTART-2026-FK94872 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read
Security vulnerability affects the prometheus-redis-exporter-fips package. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...
CLEANSTART-2026-ZG60550 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the rundeck package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-MA96870 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack
Security vulnerability affects the rundeck package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...
CLEANSTART-2026-WP23886 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments
Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...
CLEANSTART-2026-CT85138 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
Security vulnerability affects the consul package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...
CLEANSTART-2026-BU89282 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...
CLEANSTART-2024-KP03061 Use after free in Extensions API in Google Chrome prior to 92
Security vulnerability affects the chromium package. Use after free in Extensions API in Google Chrome prior to 92...
CLEANSTART-2024-PF68128 improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc
Security vulnerability affects the ffmpeg4 package. An improper integer type in the mpeg4encodegopheader function in libavcodec/mpeg4videoenc...
CLEANSTART-2024-ZP45224 FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data
Security vulnerability affects the ffmpeg4 package. FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data...
CLEANSTART-2024-DF56851 In FFmpeg 4
Security vulnerability affects the ffmpeg4 package. In FFmpeg 4...
CLEANSTART-2024-YZ84147 studio profile decoder in libavcodec/mpeg4videodec
Security vulnerability affects the ffmpeg4 package. The studio profile decoder in libavcodec/mpeg4videodec...
CLEANSTART-2024-VI83166 Use after free in WebApp Installs in Google Chrome prior to 102
Security vulnerability affects the chromium package. Use after free in WebApp Installs in Google Chrome prior to 102...
CLEANSTART-2023-FZ67908 NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in sbrprocesschannel of libfaad/sbrdec...
CLEANSTART-2023-FC29404 There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj
Security vulnerability affects the faad2 package. There is a stack-based buffer underflow in the third instance of the calculategain function in libfaad/sbrhfadj...
CLEANSTART-2023-OJ89362 NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in ifilterbank of libfaad/filtbank...
CLEANSTART-2023-HR33232 NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in icpredict of libfaad/icpredict...
CLEANSTART-2023-VH05257 invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec
Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrprocesschannel function of libfaad/sbrdec...
CLEANSTART-2023-DO62878 NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank
Security vulnerability affects the faad2 package. A NULL pointer dereference was discovered in ifilterbank of libfaad/filtbank...
CLEANSTART-2024-YI47904 report_vbuild in report
Security vulnerability affects the fetchmail package. reportvbuild in report...
CLEANSTART-2024-AG03928 PEAR Archive_Tar version 1
Security vulnerability affects the drupal7 package. PEAR ArchiveTar version 1...
CLEANSTART-2026-HK83739 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the cri-tools package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CLEANSTART-2026-UM83284 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate
Security vulnerability affects the cri-tools package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...
CLEANSTART-2025-VY76861 flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Do...
Security vulnerability affects the c-ares package. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking...
CLEANSTART-2026-XI18569 c-ares is an asynchronous resolver library
Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library...
CLEANSTART-2026-PG68728 Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters
Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...