CLEANSTART-2026-RP24727 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the trino package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-KW79982 Security fix for GHSA-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RM10286 filippo

Security vulnerability affects the temporal-server-fips package. filippo...

CLEANSTART-2026-XM93571 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...

CLEANSTART-2026-LW29584 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-SJ52043 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the external-dns package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-XR03943 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the gotenberg package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-OR76615 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CLEANSTART-2026-CJ45567 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-OL23592 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...

CLEANSTART-2026-FO54280 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-ZW99644 VP8L decoding in golang

CVE-2026-46603 affects multiple packages. VP8L decoding in golang. See references for individual vulnerability details...

CLEANSTART-2026-SS30538 Echo is a Go web framework

CVE-2026-55677 affects multiple packages. Echo is a Go web framework. See references for individual vulnerability details...

CLEANSTART-2026-LA21918 TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset

CVE-2026-46604 affects multiple packages. The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. See references for individual vulnerability details...

CLEANSTART-2026-AM91695 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

CLEANSTART-2026-CU18243 webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size

CVE-2026-46601 affects multiple packages. The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. See references for individual vulnerability details...

CLEANSTART-2026-RD95849 TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption

CVE-2026-46602 affects multiple packages. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. See references for individual vulnerability details...

CLEANSTART-2026-CD57070 Parsing a WEBP image with an invalid, large size panics on 32-bit platforms

CVE-2026-33813 affects multiple packages. Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. See references for individual vulnerability details...

CLEANSTART-2026-NI99496 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54513 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-HB97170 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54512 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-XO33463 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54515 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-JH04977 Apache Log4j Core's XmlLayout https://logging

Security vulnerability affects the wso2am package. Apache Log4j Core's XmlLayout https://logging...

CLEANSTART-2026-CP64029 Apache Log4j Core's Rfc5424Layout https://logging

Security vulnerability affects the wso2am package. Apache Log4j Core's Rfc5424Layout https://logging...

CLEANSTART-2026-UR56943 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54514 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-DM89107 When audit logging is enabled (zookeeper

Security vulnerability affects the spark package. When audit logging is enabled zookeeper...

CLEANSTART-2026-JQ32755 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the spark package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-JM28284 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the spark package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-SN07875 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-VL27493 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the spark package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-UB69946 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the wso2am package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-KP38688 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the wso2am package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-HP73429 package com

Security vulnerability affects the spark package. The package com...

CLEANSTART-2026-QQ07895 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the spark package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-DV78787 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Security vulnerability affects the spark package. Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients...

CLEANSTART-2026-OZ91827 NumberInput

Security vulnerability affects the spark package. NumberInput...

CLEANSTART-2026-LT75275 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...

CLEANSTART-2026-RK86392 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-JZ68487 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-AV92018 TypeDeserializerBase

Security vulnerability affects the spark package. TypeDeserializerBase...

CLEANSTART-2026-GM79198 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the spark package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

CLEANSTART-2026-BS92319 UTF8DataInputJsonParser

Security vulnerability affects the spark package. UTF8DataInputJsonParser...

CLEANSTART-2026-BL22559 Netty is an asynchronous, event-driven network application framework

CVE-2026-75596 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-JA68863 Netty is an asynchronous, event-driven network application framework

CVE-2026-75595 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-SY79520 Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4

Security vulnerability affects the spark package. Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4...

CLEANSTART-2026-HK72539 Netty is an asynchronous, event-driven network application framework

CVE-2026-59903 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-UA49113 Security fix for GHSA-r7wm-3cxj-wff9 applied in: sonarqube 26.6.0.123539-r0

Security vulnerability affects the sonarqube package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QN98015 Security fix for GHSA-mhm7-754m-9p8w applied in: sonarqube 26.6.0.123539-r0

Security vulnerability affects the sonarqube package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DK41558 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the sonarqube package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-BP52877 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the sonarqube package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-FH63085 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the sonarqube package. Netty is an asynchronous, event-driven network application framework...