CLEANSTART-2026-XB73842 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-NY89801 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

CLEANSTART-2026-XV17458 TypeDeserializerBase

CVE-2026-91776 affects multiple packages. TypeDeserializerBase. See references for individual vulnerability details...

CLEANSTART-2026-FJ64827 UTF8DataInputJsonParser

CVE-2026-89425 affects multiple packages. UTF8DataInputJsonParser. See references for individual vulnerability details...

CLEANSTART-2026-NV45884 Apache Log4j's JsonTemplateLayout https://logging

Security vulnerability affects the spark-sc213-jdk17-py312 package. Apache Log4j's JsonTemplateLayout https://logging...

CLEANSTART-2026-HV49575 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106452 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-QB31666 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106450 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-PM70548 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106453 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-MS32897 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-TX68944 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106451 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-ZR73377 Security fix for GHSA-jcj7-v34w-v9vv applied in: valkey 9.1.2-r0

Security vulnerability affects the valkey package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TY09591 Security fix for GHSA-fq2f-crmw-q97r applied in: valkey 9.1.2-r0

Security vulnerability affects the valkey package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VA16000 Improper access control in subsystem for BlueZ before version 5

Security vulnerability affects the bluez package. Improper access control in subsystem for BlueZ before version 5...

CLEANSTART-2026-KA88072 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer

CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...

CLEANSTART-2026-ML70772 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CLEANSTART-2026-ZX34882 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CLEANSTART-2026-VI85539 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-NZ57247 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-QO55945 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-WY73031 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-SA69441 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-HU64344 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-LD70674 When http

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...

CLEANSTART-2026-HC65345 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-PW41000 Security fix for GHSA-6v7p-g79w-8964 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QB58393 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-XM81599 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Security vulnerability affects the k8s-sidecar package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CLEANSTART-2026-JM52525 Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RH44885 Alertmanager handles alerts sent by client applications such as the Prometheus server

Security vulnerability affects the grafana package. Alertmanager handles alerts sent by client applications such as the Prometheus server...

CLEANSTART-2026-PZ20042 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

Security vulnerability affects the k8s-sidecar package. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages...

CLEANSTART-2026-OX34995 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-PH12494 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-DG38961 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the grafana package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-ZA90599 Security fix for CVE-2026-49265 applied in: k8s-sidecar 2.8.2-r1

Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UX80273 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-WE83392 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-YG47878 urllib3 is an HTTP client library for Python

Security vulnerability affects the k8s-sidecar package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-YM59079 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the grafana package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-MK95197 Security fix for GHSA-rgwj-5xj2-c3m3 applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VM49964 ApostropheCMS is an open-source Node

Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...

CLEANSTART-2026-OT92390 ### Summary `qs

Security vulnerability affects the n8n package. Summary qs...

CLEANSTART-2026-LG36939 ApostropheCMS is an open-source Node

Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...

CLEANSTART-2026-JI81850 ### Summary When `qs

Security vulnerability affects the n8n package. Summary When qs...

CLEANSTART-2026-WP11849 Security fix for GHSA-3f6p-5ww8-9rcr applied in: n8n 2.28.0-r4

Security vulnerability affects the n8n package. This issue is resolved in later releases. See references for vulnerability details...