11796 matches found
CLEANSTART-2026-BM84201 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)
CVE-2024-21147 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. See references for individual vulnerability details...
CLEANSTART-2026-KV92980 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)
CVE-2025-30749 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. See references for individual vulnerability details...
CLEANSTART-2026-TY39541 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting)
CVE-2025-30761 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. See references for individual vulnerability details...
CLEANSTART-2026-JD75109 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
CVE-2025-30754 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. See references for individual vulnerability details...
CLEANSTART-2026-BL21705 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
CVE-2025-53057 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. See references for individual vulnerability details...
CLEANSTART-2026-MA15395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
CVE-2025-53066 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. See references for individual vulnerability details...
CLEANSTART-2026-LQ63526 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
CVE-2025-61748 affects multiple packages. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. See references for individual vulnerability details...
CLEANSTART-2026-YV55708 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
Security vulnerability affects the wave package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
CLEANSTART-2026-PU34028 On Windows, when the target of Root
CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...
CLEANSTART-2026-YX80273 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...
CLEANSTART-2026-UX87470 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...
CLEANSTART-2026-UU45005 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes
CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...
CLEANSTART-2026-JN25142 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...
CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...
CLEANSTART-2026-IX85296 When http
CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...
CLEANSTART-2026-QG19683 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...
CLEANSTART-2026-QI90513 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...
CLEANSTART-2026-AO15558 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...
CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...
CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...
CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...
CLEANSTART-2026-RA51574 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...
Security vulnerability affects the wave package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...
CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...
CLEANSTART-2026-OF55498 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Security vulnerability affects the wave package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...
CLEANSTART-2026-CV08695 tjLoadImage function in libjpeg-turbo 2
Security vulnerability affects the libjpeg-turbo package. The tjLoadImage function in libjpeg-turbo 2...
CLEANSTART-2026-EG09226 libjpeg-turbo 1
Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 1...
CLEANSTART-2026-IQ56937 libjpeg 9c has a large loop because read_pixel in rdtarga
Security vulnerability affects the libjpeg-turbo package. libjpeg 9c has a large loop because readpixel in rdtarga...
CLEANSTART-2026-ET03360 In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon
Security vulnerability affects the libjpeg-turbo package. In generatejsimdyccrgbconvertneon of jsimdarm64neon...
CLEANSTART-2026-BY32153 libjpeg-turbo 2
Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 2...
CLEANSTART-2026-YE92089 Libjpeg-turbo versions 2
Security vulnerability affects the libjpeg-turbo package. Libjpeg-turbo versions 2...
CLEANSTART-2026-EW60545 heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext
Security vulnerability affects the libjpeg-turbo package. A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2mergedupsampleinternal function of jdmrgext...
CLEANSTART-2026-GF49451 libjpeg-turbo 2
Security vulnerability affects the libjpeg-turbo package. libjpeg-turbo 2...
CLEANSTART-2026-AW54211 crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo
Security vulnerability affects the libjpeg-turbo package. A crafted input file could cause a null pointer dereference in jcopysamplerows when processed by libjpeg-turbo...
CLEANSTART-2026-DC31578 `github
Security vulnerability affects the gosu package. The github...
CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CLEANSTART-2026-UM59263 snappy-java through 1
Security vulnerability affects the solr package. snappy-java through 1...
CLEANSTART-2026-VP40557 snappy-java through 1
Security vulnerability affects the solr package. snappy-java through 1...
CLEANSTART-2026-XV24797 snappy-java through 1
Security vulnerability affects the solr package. snappy-java through 1...
CLEANSTART-2026-CQ05064 Netty is an asynchronous, event-driven network application framework
Security vulnerability affects the solr package. Netty is an asynchronous, event-driven network application framework...
CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...
CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...
CLEANSTART-2026-EA97597 Netty (io
Security vulnerability affects the solr package. Netty io...
CLEANSTART-2026-XR18271 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",
CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...
CLEANSTART-2026-IE92648 client may issue specially crafted HTTP/1
Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...
CLEANSTART-2026-PX58451 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check
CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...
CLEANSTART-2026-AW63553 jackson-databind binds a JSON string to a javax
Security vulnerability affects the solr package. jackson-databind binds a JSON string to a javax...
CLEANSTART-2026-QY26018 When audit logging is enabled (zookeeper
CVE-2026-84439 affects multiple packages. When audit logging is enabled zookeeper. See references for individual vulnerability details...
CLEANSTART-2026-HW50386 Netty is an asynchronous, event-driven network application framework
Security vulnerability affects the solr package. Netty is an asynchronous, event-driven network application framework...
CLEANSTART-2026-ZO47160 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...
CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...
CLEANSTART-2026-UZ99308 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
Security vulnerability affects the solr package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator...