CLEANSTART-2026-CW76652 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-CG08650 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-IP96561 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-OQ39308 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-GA98365 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-WH43251 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-QR87061 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-PD49878 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-TY25430 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-TN63603 urllib3 is an HTTP client library for Python

Security vulnerability affects the apache-superset package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-TV45483 urllib3 is an HTTP client library for Python

Security vulnerability affects the apache-superset package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-JH53704 Werkzeug is a comprehensive WSGI web application library

CVE-2026-102598 affects multiple packages. Werkzeug is a comprehensive WSGI web application library. See references for individual vulnerability details...

CLEANSTART-2026-QB35477 geopy is a geocoding library for Python

CVE-2026-77387 affects multiple packages. geopy is a geocoding library for Python. See references for individual vulnerability details...

CLEANSTART-2026-PP41218 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit

Security vulnerability affects the php package. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit...

CLEANSTART-2026-GS69152 When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, ...

Security vulnerability affects the php package. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP...

CLEANSTART-2026-OZ96009 Security fix for GHSA-ch8v-r6jh-4vvr applied in: php 8.3.35-r0

Security vulnerability affects the php package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XM64150 IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen

Security vulnerability affects the php package. The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen...

CLEANSTART-2026-JC19240 php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl

Security vulnerability affects the php package. phpopensslmatcheswildcardname in ext/openssl/xpssl...

CLEANSTART-2026-NP31070 When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location

Security vulnerability affects the php package. When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location...

CLEANSTART-2026-AU05968 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name

Security vulnerability affects the php package. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name...

CLEANSTART-2026-HM12202 convert

Security vulnerability affects the php package. The convert...

CLEANSTART-2026-ZN45327 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check

Security vulnerability affects the php package. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check...

CLEANSTART-2026-UY82629 mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them

Security vulnerability affects the php package. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them...

CLEANSTART-2026-WW44198 SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger

Security vulnerability affects the php package. The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger...

CLEANSTART-2026-VP35771 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

CLEANSTART-2026-VN99750 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

CLEANSTART-2026-QV19791 Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator-fips 2.12.0-r1, flux-helm-controller 1.6.4-r1

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AH23737 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

CLEANSTART-2026-CC29276 Security fix for GHSA-259r-337f-4rfw applied in: node-problem-detector 0.8.25-r1

Security vulnerability affects the node-problem-detector package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GD06163 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the node-problem-detector package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-KG18431 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-MS30353 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-29181 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-XV27173 norm

CVE-2026-56852 affects multiple packages. A norm. See references for individual vulnerability details...

CLEANSTART-2026-PV83976 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-KZ65595 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the node-problem-detector package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-SV16183 NewNTUnicodeString does not check for string length overflow

CVE-2026-39824 affects multiple packages. NewNTUnicodeString does not check for string length overflow. See references for individual vulnerability details...

CLEANSTART-2026-BP22763 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-YK40300 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the node-problem-detector package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-ED67478 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-AW83562 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-EG45890 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-ZC63840 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-IQ69841 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-TJ27898 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-HW01604 For certain crafted inputs, a 'ed25519

CVE-2026-46598 affects multiple packages. For certain crafted inputs, a 'ed25519. See references for individual vulnerability details...

CLEANSTART-2026-QO22872 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-FL49785 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-TR67175 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-NH44106 gRPC-Go is the Go language implementation of gRPC

CVE-2026-33186 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-AL79181 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...