11796 matches found
CLEANSTART-2026-VC78529 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component
Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...
CLEANSTART-2026-JM42748 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1
Security vulnerability affects the apache-nifi package. Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1...
CLEANSTART-2026-EQ65269 Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the follo...
Security vulnerability affects the apache-nifi package. Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString...
CLEANSTART-2026-IR60609 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS)
Security vulnerability affects the apache-nifi package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS...
CLEANSTART-2026-CJ74224 Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPaylo...
Security vulnerability affects the apache-nifi package. Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted...
CLEANSTART-2026-NA10191 Authorization handling for component configuration verification requests in Apache NiFi 1
Security vulnerability affects the apache-nifi package. Authorization handling for component configuration verification requests in Apache NiFi 1...
CLEANSTART-2026-GV33004 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator
Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...
CLEANSTART-2026-EM62923 Uncontrolled Recursion vulnerability in Apache Commons
CVE-2026-45205 affects multiple packages. Uncontrolled Recursion vulnerability in Apache Commons. See references for individual vulnerability details...
CLEANSTART-2026-BN04389 fix for CVE-2026-41409 was not applied to the 2
Security vulnerability affects the apache-nifi package. The fix for CVE-2026-41409 was not applied to the 2...
CLEANSTART-2026-BA63777 Apache NiFi 1
Security vulnerability affects the apache-nifi package. Apache NiFi 1...
CLEANSTART-2026-WX93243 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...
Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...
CLEANSTART-2026-EN89186 Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack
Security vulnerability affects the apache-nifi package. Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack...
CLEANSTART-2026-PK17424 In an untrusted JMS environment, org
Security vulnerability affects the apache-nifi package. In an untrusted JMS environment, org...
CLEANSTART-2026-BJ70154 Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests
Security vulnerability affects the apache-nifi package. Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests...
CLEANSTART-2026-GX72554 fix for CVE-2026-41635 was not applied to the 2
Security vulnerability affects the apache-nifi package. The fix for CVE-2026-41635 was not applied to the 2...
CLEANSTART-2026-SU09873 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...
Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...
CLEANSTART-2026-VV78172 Apache NiFi 1
Security vulnerability affects the apache-nifi package. Apache NiFi 1...
CLEANSTART-2026-FU03579 Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payl...
Security vulnerability affects the apache-nifi package. Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a...
CLEANSTART-2026-ID47873 Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution
Security vulnerability affects the apache-nifi package. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution...
CLEANSTART-2026-OR53843 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...
Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...
CLEANSTART-2026-FS57151 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-BT04597 Apache MINA's AbstractIoBuffer
Security vulnerability affects the apache-nifi package. Apache MINA's AbstractIoBuffer...
CLEANSTART-2026-CP43457 attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters
Security vulnerability affects the apache-nifi package. An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...
CLEANSTART-2026-VT93127 Vulnerability in Spring Spring Security
Security vulnerability affects the apache-nifi package. Vulnerability in Spring Spring Security...
CLEANSTART-2026-XK50947 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly
Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...
CLEANSTART-2026-RV47518 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written
Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...
CLEANSTART-2026-HV53222 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics
Security vulnerability affects the apache-nifi package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...
CLEANSTART-2026-KN06820 Information exposure vulnerability has been identified in Apache Kafka
Security vulnerability affects the apache-nifi package. Information exposure vulnerability has been identified in Apache Kafka...
CLEANSTART-2026-YB42445 Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters
Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...
CLEANSTART-2026-TG02520 fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer
Security vulnerability affects the apache-nifi package. The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer...
CLEANSTART-2026-ZK87180 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-TF05670 Out-of-bounds memory operations in org
Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...
CLEANSTART-2026-PV64921 In Eclipse Jetty, the HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...
CLEANSTART-2026-XW11767 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...
CLEANSTART-2026-TY92460 Critical XXE in Apache Tika tika-core (1
Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...
CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CLEANSTART-2026-ZE47134 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
CLEANSTART-2026-EB27094 In Eclipse Jetty, a first HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...
CLEANSTART-2026-SN03087 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...
CLEANSTART-2026-KF29618 Apache NiFi 1
Security vulnerability affects the apache-nifi package. Apache NiFi 1...
CLEANSTART-2026-MN49716 In Eclipse Jetty, versions 12
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions 12...
CLEANSTART-2026-RB25036 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...
CLEANSTART-2026-BC80499 In Eclipse Jetty, an HTTP URI of this form: /public;/
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...
CLEANSTART-2026-OE66556 In Jakarta Mail versions prior to 2
Security vulnerability affects the apache-nifi package. In Jakarta Mail versions prior to 2...
CLEANSTART-2026-SV89118 Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics
Security vulnerability affects the apache-nifi package. The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics...
CLEANSTART-2026-EO53976 In Eclipse Jetty versions 12
Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12...
CLEANSTART-2026-DA06561 In Eclipse Jetty, versions <=9
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions =9...
CLEANSTART-2026-AU34344 In jose4j before 0
Security vulnerability affects the apache-nifi package. In jose4j before 0...
CLEANSTART-2026-PA10203 norm
Security vulnerability affects the loki package. A norm...
CLEANSTART-2026-IY45098 Security fix for GHSA-hrxh-6v49-42gf applied in: loki 3.6.11-r0
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...