CLEANSTART-2026-WR72831 Security fix for GHSA-g7r4-m6w7-qqqr applied in: renovate 43.177.9-r1, renovate 43.180.0-r1

GHSA-g7r4-m6w7-qqqr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZS06446 Security fix for GHSA-r4xh-jqrq-34v2 applied in: renovate 43.177.9-r1, renovate 43.180.0-r1

GHSA-r4xh-jqrq-34v2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZU45548 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

CLEANSTART-2026-XE88447 protobufjs compiles protobuf definitions into JavaScript (JS) functions

CVE-2026-54269 affects multiple packages. protobufjs compiles protobuf definitions into JavaScript JS functions. See references for individual vulnerability details...

CLEANSTART-2026-VG34156 ### Summary When `qs

CVE-2026-82562 affects multiple packages. Summary When qs. See references for individual vulnerability details...

CLEANSTART-2026-ZS88372 Security fix for GHSA-253c-mchw-3w2r applied in: renovate 43.177.9-r1, renovate 43.180.0-r1

GHSA-253c-mchw-3w2r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZI17820 js-yaml is a JavaScript YAML parser and dumper

CVE-2026-53550 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...

CLEANSTART-2026-VT69653 weakness has been identified in jsonata-js jsonata up to 2

CVE-2026-12208 affects multiple packages. A weakness has been identified in jsonata-js jsonata up to 2. See references for individual vulnerability details...

CLEANSTART-2026-YW31790 opentelemetry-js is the OpenTelemetry JavaScript Client

CVE-2026-54285 affects multiple packages. opentelemetry-js is the OpenTelemetry JavaScript Client. See references for individual vulnerability details...

CLEANSTART-2026-WK56892 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

CVE-2026-42338 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-ZV74526 Handlebars provides the power necessary to let users build semantic templates

CVE-2026-106444 affects multiple packages. Handlebars provides the power necessary to let users build semantic templates. See references for individual vulnerability details...

CLEANSTART-2026-VM07662 Security fix for GHSA-5p4m-2wfm-xmqj applied in: renovate 43.177.9-r1, renovate 43.180.0-r1

GHSA-5p4m-2wfm-xmqj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YP30381 protobufjs compiles protobuf definitions into JavaScript (JS) functions

CVE-2026-48712 affects multiple packages. protobufjs compiles protobuf definitions into JavaScript JS functions. See references for individual vulnerability details...

CLEANSTART-2026-WM48564 fast-uri is a URI parser for Node

CVE-2026-76172 affects multiple packages. fast-uri is a URI parser for Node. See references for individual vulnerability details...

CLEANSTART-2026-UE15220 fast-uri is a URI parser for Node

CVE-2026-75975 affects multiple packages. fast-uri is a URI parser for Node. See references for individual vulnerability details...

CLEANSTART-2026-VX74445 JSONata is a JSON query and transformation language

CVE-2026-77415 affects multiple packages. JSONata is a JSON query and transformation language. See references for individual vulnerability details...

CLEANSTART-2026-UW23972 simple-git, an interface for running git commands in any node

CVE-2026-102827 affects multiple packages. simple-git, an interface for running git commands in any node. See references for individual vulnerability details...

CLEANSTART-2026-VO75724 Handlebars provides the power necessary to let users build semantic templates

CVE-2026-106446 affects multiple packages. Handlebars provides the power necessary to let users build semantic templates. See references for individual vulnerability details...

CLEANSTART-2026-YG53866 vulnerability was determined in postcss-selector-parser up to 6

CVE-2026-9358 affects multiple packages. A vulnerability was determined in postcss-selector-parser up to 6. See references for individual vulnerability details...

CLEANSTART-2026-YO55047 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48815 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-XK88053 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

CVE-2026-101912 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-ZM83818 brace-expansion library generates arbitrary strings containing a common prefix and suffix

CVE-2026-69152 affects multiple packages. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. See references for individual vulnerability details...

CLEANSTART-2026-WI94588 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CLEANSTART-2026-YT71369 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CLEANSTART-2026-UM72730 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-YT84252 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-UN12409 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-ZB05903 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-VB49028 zstd-jni before 1

Security vulnerability affects the trino package. zstd-jni before 1...

CLEANSTART-2026-VH51135 In Reactor Core, applications that use the Flux

Security vulnerability affects the trino package. In Reactor Core, applications that use the Flux...

CLEANSTART-2026-WG76830 vulnerability has been found in luben zstd-jni up to 1

Security vulnerability affects the trino package. A vulnerability has been found in luben zstd-jni up to 1...

CLEANSTART-2026-ZO58617 zstd-jni versions before 1

Security vulnerability affects the trino package. zstd-jni versions before 1...

CLEANSTART-2026-VU34498 zstd-jni before 1

Security vulnerability affects the trino package. zstd-jni before 1...

CLEANSTART-2026-YL87425 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-XO95382 For certain crafted inputs, a 'ed25519

CVE-2026-46598 affects multiple packages. For certain crafted inputs, a 'ed25519. See references for individual vulnerability details...

CLEANSTART-2026-UP46594 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

CVE-2026-39831 affects multiple packages. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh. See references for individual vulnerability details...

CLEANSTART-2026-ZE97258 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-ZR26286 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the grafana-alloy package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

CLEANSTART-2026-UC39319 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

CLEANSTART-2026-UA04253 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-VJ29076 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-ZE24156 Security fix for GHSA-w44r-93j7-qv28 applied in: rustup 1.28.2-r4

Security vulnerability affects the rustup package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZS53659 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

CLEANSTART-2026-WV26329 In Eclipse Parsson published Maven Central artifacts before version 1

Security vulnerability affects the keycloak package. In Eclipse Parsson published Maven Central artifacts before version 1...

CLEANSTART-2026-UR21896 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

Security vulnerability affects the keycloak package. MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases...

CLEANSTART-2026-ZV89277 In Eclipse Vert

Security vulnerability affects the keycloak package. In Eclipse Vert...

CLEANSTART-2026-VW00414 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the keycloak package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-XW40914 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the keycloak package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-UI85018 jackson-databind's deserializer for java

Security vulnerability affects the keycloak package. jackson-databind's deserializer for java...

CLEANSTART-2026-XA48515 Security fix for GHSA-f6x5-jh6r-wrfv applied in: gatekeeper-fips 3.20.1-r0

Security vulnerability affects the gatekeeper-fips package. This issue is resolved in later releases. See references for vulnerability details...