11796 matches found
CLEANSTART-2026-PP64708 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)
Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...
CLEANSTART-2026-VB21846 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)
Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...
CLEANSTART-2026-GB20617 Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature
Security vulnerability affects the sonarqube package. Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature...
CLEANSTART-2026-HK32030 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130)
Security vulnerability affects the sonarqube package. Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130...
CLEANSTART-2026-IX22317 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API
Security vulnerability affects the sonarqube package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...
CLEANSTART-2026-AE99282 In PHP 8
Security vulnerability affects the php package. In PHP 8...
CLEANSTART-2026-CK30216 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-YY93268 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-YW89455 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-UW00601 In PHP version 8
Security vulnerability affects the php package. In PHP version 8...
CLEANSTART-2026-GO78577 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-QQ38336 Due to an incomplete fix to CVE-2022-31629 https://github
Security vulnerability affects the php package. Due to an incomplete fix to CVE-2022-31629 https://github...
CLEANSTART-2026-QY88672 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-YP64784 JLine is a Java library for handling console input
Security vulnerability affects the trino package. JLine is a Java library for handling console input...
CLEANSTART-2026-FO52414 jackson-databind's deserializer for java
Security vulnerability affects the trino package. jackson-databind's deserializer for java...
CLEANSTART-2026-XY46108 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
Security vulnerability affects the trino package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator...
CLEANSTART-2026-WW59813 TypeDeserializerBase
Security vulnerability affects the trino package. TypeDeserializerBase...
CLEANSTART-2026-LG94890 JLine is a Java library for handling console input
Security vulnerability affects the trino package. JLine is a Java library for handling console input...
CLEANSTART-2026-MJ80474 client may issue specially crafted HTTP/1
Security vulnerability affects the trino package. A client may issue specially crafted HTTP/1...
CLEANSTART-2026-BM41905 jackson-databind binds a JSON string to a javax
Security vulnerability affects the trino package. jackson-databind binds a JSON string to a javax...
CLEANSTART-2026-EJ84635 UTF8DataInputJsonParser
Security vulnerability affects the trino package. UTF8DataInputJsonParser...
CLEANSTART-2026-JK65929 NumberInput
Security vulnerability affects the trino package. NumberInput...
CLEANSTART-2026-AJ37436 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
Security vulnerability affects the trino package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...
CLEANSTART-2026-IL95812 urllib3 is an HTTP client library for Python
CVE-2026-97689 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-ZK07015 urllib3 is an HTTP client library for Python
CVE-2026-97688 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-DF15626 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages
CVE-2026-59890 affects multiple packages. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. See references for individual vulnerability details...
CLEANSTART-2026-DW54013 urllib3 is an HTTP client library for Python
CVE-2026-97687 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...
CLEANSTART-2026-KG31017 MessagePack is the serializer implementation for Python msgpack
CVE-2026-57585 affects multiple packages. MessagePack is the serializer implementation for Python msgpack. See references for individual vulnerability details...
CLEANSTART-2026-FL31642 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages
CVE-2025-47273 affects multiple packages. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. See references for individual vulnerability details...
CLEANSTART-2026-KD93591 Security fix for GHSA-6v7p-g79w-8964 applied in: py3.12-pip 26.2-r0, py3-pip 26.2-r2
GHSA-6v7p-g79w-8964 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-WO88386 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-QT50879 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-MA26446 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-RO34985 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-AU70516 Previously, a channel registered in the mux's chanList is not usable until it is established
CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
CLEANSTART-2026-BM76577 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings
CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...
CLEANSTART-2026-FN36797 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-AG86727 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...
CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...
CLEANSTART-2026-WK54237 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
CVE-2026-39830 affects multiple packages. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. See references for individual vulnerability details...
CLEANSTART-2026-FO00940 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...
CLEANSTART-2026-KC53993 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh
CVE-2026-39832 affects multiple packages. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh. See references for individual vulnerability details...
CLEANSTART-2026-YR68258 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...
CLEANSTART-2026-UZ18323 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it
CVE-2026-39833 affects multiple packages. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. See references for individual vulnerability details...
CLEANSTART-2026-EA72905 RSA and DSA public key parsers did not enforce size limits on key parameters
CVE-2026-39829 affects multiple packages. The RSA and DSA public key parsers did not enforce size limits on key parameters. See references for individual vulnerability details...
CLEANSTART-2026-EN30370 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh
CVE-2026-39831 affects multiple packages. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh. See references for individual vulnerability details...
CLEANSTART-2026-ZF54924 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...
CLEANSTART-2026-HI18999 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-PB13489 gRPC-Go is the Go language implementation of gRPC
Security vulnerability affects the temporal-server package. gRPC-Go is the Go language implementation of gRPC...
CLEANSTART-2026-EX19348 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-IZ71497 For certain crafted inputs, a 'ed25519
CVE-2026-46598 affects multiple packages. For certain crafted inputs, a 'ed25519. See references for individual vulnerability details...