CLEANSTART-2023-XP88498 do_core_note in readelf

Security vulnerability affects the file package. docorenote in readelf...

CLEANSTART-2024-UY59610 search_make_new function in evdns

Security vulnerability affects the libevent package. The searchmakenew function in evdns...

CLEANSTART-2023-CA86260 do_bid_note in readelf

Security vulnerability affects the file package. dobidnote in readelf...

CLEANSTART-2023-MI80825 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation

Security vulnerability affects the file package. ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation...

CLEANSTART-2024-EN82198 Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil

Security vulnerability affects the libevent package. Stack-based buffer overflow in the evutilparsesockaddrport function in evutil...

CLEANSTART-2023-RS81674 cdf_read_property_info in cdf

Security vulnerability affects the file package. cdfreadpropertyinfo in cdf...

CLEANSTART-2024-EI97817 name_parse function in evdns

Security vulnerability affects the libevent package. The nameparse function in evdns...

CLEANSTART-2024-XI23677 Cyrus SASL 2

Security vulnerability affects the cyrus-sasl package. Cyrus SASL 2...

CLEANSTART-2024-GV41278 cyrus-sasl (aka Cyrus SASL) 2

Security vulnerability affects the cyrus-sasl package. cyrus-sasl aka Cyrus SASL 2...

CLEANSTART-2024-FU19222 GNU Multiple Precision Arithmetic Library (GMP) through 6

Security vulnerability affects the gmp package. GNU Multiple Precision Arithmetic Library GMP through 6...

CLEANSTART-2024-NP33069 exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1

Security vulnerability affects the e2fsprogs package. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1...

CLEANSTART-2024-DV01565 In Cyrus SASL 2

Security vulnerability affects the cyrus-sasl package. In Cyrus SASL 2...

CLEANSTART-2024-DX96304 code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1

Security vulnerability affects the e2fsprogs package. A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1...

CLEANSTART-2025-VY76861 flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Do...

Security vulnerability affects the c-ares package. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking...

CLEANSTART-2025-FK62807 c-ares is a C library for asynchronous DNS requests

Security vulnerability affects the c-ares package. c-ares is a C library for asynchronous DNS requests...

CLEANSTART-2026-XP51348 Security fix for GHSA-jq53-42q6-pqr5 applied in: c-ares 1.34.5-r0

Security vulnerability affects the c-ares package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JO91864 Use-after-free vulnerability in bzip2recover in bzip2 1

Security vulnerability affects the bzip2 package. Use-after-free vulnerability in bzip2recover in bzip2 1...

CLEANSTART-2025-JX38595 c-ares is an asynchronous resolver library

Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library...

CLEANSTART-2026-XI18569 c-ares is an asynchronous resolver library

Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library...

CLEANSTART-2026-PN21117 BZ2_decompress in decompress

Security vulnerability affects the bzip2 package. BZ2decompress in decompress...

CLEANSTART-2026-WO62988 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-39883 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-QL84214 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

CVE-2026-39825 affects multiple packages. ReverseProxy can forward queries containing parameters not visible to Rewrite functions. See references for individual vulnerability details...

CLEANSTART-2026-RR70379 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

CVE-2026-39836 affects multiple packages. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0. See references for individual vulnerability details...

CLEANSTART-2026-CS99408 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

CLEANSTART-2026-EF65373 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...

CLEANSTART-2026-QF93365 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-RV93629 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

CVE-2026-39820 affects multiple packages. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...

CLEANSTART-2026-DN56555 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

CLEANSTART-2026-EH49722 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-NB79781 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the cri-tools package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-KQ03860 Security fix for GHSA-r7wm-3cxj-wff9 applied in: apache-nifi 2.5.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MD90103 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-PD40538 (*x509

Security vulnerability affects the cri-tools package. x509...

CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax

Security vulnerability affects the apache-nifi package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-CI22056 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

CVE-2026-83557 affects multiple packages. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. See references for individual vulnerability details...

CLEANSTART-2026-LG89593 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the cri-tools package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-GQ65848 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-EK15836 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

CLEANSTART-2026-BX15476 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

CLEANSTART-2026-SJ80754 Apache NiFi 0

Security vulnerability affects the apache-nifi package. Apache NiFi 0...

CLEANSTART-2026-WH10300 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-XF54528 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-GO38541 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-DD70166 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-FR49757 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-TP37792 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

CVE-2026-32283 affects multiple packages. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. See references for individual vulnerability details...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-FS98881 On Linux, if the target of Root

CVE-2026-32282 affects multiple packages. On Linux, if the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-ML93784 SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X

Security vulnerability affects the apache-nifi package. SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X...

CLEANSTART-2026-CV55977 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...