11796 matches found
CLEANSTART-2026-KI17515 tar
CVE-2026-32288 affects multiple packages. tar. See references for individual vulnerability details...
CLEANSTART-2026-XR21896 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-ZT93395 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...
CLEANSTART-2026-CG80075 etcd is a distributed key-value store for the data of a distributed system
CVE-2026-73500 affects multiple packages. etcd is a distributed key-value store for the data of a distributed system. See references for individual vulnerability details...
CLEANSTART-2026-UJ30602 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-CD04274 Security fix for GHSA-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0
GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-JE59427 Previously, a channel registered in the mux's chanList is not usable until it is established
CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
CLEANSTART-2026-RX78395 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.20.0-r3, eks-distro-kube-scheduler 1.36.9-r2, eks-distro-kube-controller-manager-fips 1.36.8-r0, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0
GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-DX35599 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-UX70251 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-PP00829 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-ZX49959 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-HZ96521 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-ZS73776 Security fix for GHSA-8wmf-6v46-5gfg applied in: eks-distro-kube-scheduler-fips 1.35.14-r0, eks-distro-kube-controller-manager-fips 1.36.8-r1, eks-distro-kube-apiserver 1.36.8-r2, eks-distro-kube-apiserver-fips 1.36.8-r1
GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-BP29936 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-QQ14312 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-JL61166 jackson-databind's deserializer for java
CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...
CLEANSTART-2026-BM20814 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...
CLEANSTART-2026-QH78239 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-AY37213 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces
Security vulnerability affects the apache-nifi-registry package. Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces...
CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-GG30047 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
Security vulnerability affects the apache-nifi-registry package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
CLEANSTART-2026-AA31447 Several components in Spring Security compare security-sensitive values using standard string equality (String
Security vulnerability affects the apache-nifi-registry package. Several components in Spring Security compare security-sensitive values using standard string equality String...
CLEANSTART-2026-LZ14873 Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability
Security vulnerability affects the apache-nifi-registry package. Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability...
CLEANSTART-2026-KL61134 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store
Security vulnerability affects the apache-nifi-registry package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...
CLEANSTART-2026-DS55761 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name
Security vulnerability affects the apache-nifi-registry package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
CLEANSTART-2026-IL27901 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors
Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...
CLEANSTART-2026-AM86994 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...
Security vulnerability affects the apache-nifi-registry package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...
CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...
Security vulnerability affects the apache-nifi-registry package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...
CLEANSTART-2026-GT33551 Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password
Security vulnerability affects the apache-nifi-registry package. Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password...
CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CLEANSTART-2026-TG84112 In Bouncy Castle for Java before 1
CVE-2026-58063 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-IP81999 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active
Security vulnerability affects the apache-nifi-registry package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...
CLEANSTART-2026-CF84062 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit
Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CLEANSTART-2026-PE22489 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...
Security vulnerability affects the apache-nifi-registry package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent...
CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
CLEANSTART-2026-YE65839 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request
Security vulnerability affects the apache-nifi-registry package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...
CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-MH81901 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments
Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...
CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute
Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...
CLEANSTART-2026-PX22930 In Bouncy Castle for Java before 1
CVE-2026-59647 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-BM08082 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...
Security vulnerability affects the apache-nifi-registry package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...
CLEANSTART-2026-SU76739 In Bouncy Castle for Java before 1
CVE-2026-12803 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-YI71771 In Bouncy Castle for Java before 1
CVE-2026-59648 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-TN87218 In Bouncy Castle for Java before 1
CVE-2026-12860 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...
CLEANSTART-2026-XM21821 In Bouncy Castle for Java before 1
CVE-2026-58061 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...