CLEANSTART-2026-FG96390 Security fix for GHSA-8wmf-6v46-5gfg applied in: kube-state-metrics-fips 2.19.1-r2

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ST13970 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-ON08381 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the kube-state-metrics-fips package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-CH48185 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the kube-state-metrics-fips package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-SU70558 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the kube-state-metrics-fips package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-ID25713 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the kube-state-metrics-fips package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-HO44930 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the kube-state-metrics-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-BS59545 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the kube-state-metrics-fips package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-NB75490 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Security vulnerability affects the cri-tools package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed...

CLEANSTART-2026-XL50030 When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system

Security vulnerability affects the azure-functions-extension-bundles package. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system...

CLEANSTART-2026-XX95180 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Security vulnerability affects the py3-anyio package. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio...

CLEANSTART-2026-YJ27178 hpack is an HTTP/2 Header Encoding for Python

Security vulnerability affects the py3-hpack package. hpack is an HTTP/2 Header Encoding for Python...

CLEANSTART-2023-ZV80207 Dino before 0

Security vulnerability affects the dino package. Dino before 0...

CLEANSTART-2023-TR32698 Dino before 0

Security vulnerability affects the dino package. Dino before 0...

CLEANSTART-2024-WS30553 libdiscover/backends/KNSBackend/KNSResource

Security vulnerability affects the discover package. libdiscover/backends/KNSBackend/KNSResource...

CLEANSTART-2024-WM30423 diffoscope before 256 allows directory traversal via an embedded filename in a GPG file

Security vulnerability affects the diffoscope package. diffoscope before 256 allows directory traversal via an embedded filename in a GPG file...

CLEANSTART-2023-NP57174 CVS 1

Security vulnerability affects the cvs package. CVS 1...

CLEANSTART-2023-RT70997 Heap-based buffer overflow in the proxy_connect function in src/client

Security vulnerability affects the cvs package. Heap-based buffer overflow in the proxyconnect function in src/client...

CLEANSTART-2023-FB56877 Array index error in the apply_rcs_change function in rcs

Security vulnerability affects the cvs package. Array index error in the applyrcschange function in rcs...

CLEANSTART-2024-AG66831 regex is an implementation of regular expressions for the Rust language

CVE-2022-24713 affects multiple packages. regex is an implementation of regular expressions for the Rust language. See references for individual vulnerability details...

CLEANSTART-2024-CB04039 cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos

Security vulnerability affects the cups-filters package. cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos...

CLEANSTART-2024-DU60116 jscript

Security vulnerability affects the ctags package. jscript...

CLEANSTART-2023-SQ43460 issue was discovered in LINBIT csync2 through 2

Security vulnerability affects the csync2 package. An issue was discovered in LINBIT csync2 through 2...

CLEANSTART-2023-MQ78047 issue was discovered in LINBIT csync2 through 2

Security vulnerability affects the csync2 package. An issue was discovered in LINBIT csync2 through 2...

CLEANSTART-2024-EW13747 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-RB67185 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-VX69148 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-YM37206 flaw was found in crun where containers were incorrectly started with non-empty default permissions

Security vulnerability affects the crun package. A flaw was found in crun where containers were incorrectly started with non-empty default permissions...

CLEANSTART-2024-FA11373 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-MU32583 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-PY24783 issue was discovered in Croc through 9

Security vulnerability affects the croc package. An issue was discovered in Croc through 9...

CLEANSTART-2024-HW80621 Security fix for CVE-2021-31603 applied in: croc 9.1.0-r0

Security vulnerability affects the croc package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VF61334 When returning errors, functions in the net/textproto package would include its input as part of the error

CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...

CLEANSTART-2026-MR47153 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-CF09706 (*x509

CVE-2026-27145 affects multiple packages. x509. See references for individual vulnerability details...

CLEANSTART-2026-GF82267 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-YN61709 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-NC34372 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-CR23307 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-EV76983 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-WJ82111 Security fix for GHSA-p436-gjf2-799p applied in: buildkitd 0.26.3-r1, crane 0.18.0-r1, crane 0.19.2-r0, crane 0.20.7-r1

GHSA-p436-gjf2-799p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NT42167 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

CVE-2025-15558 affects multiple packages. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. See references for individual vulnerability details...

CLEANSTART-2026-AH15669 Security fix for GHSA-259r-337f-4rfw applied in: crane 0.19.2-r1, crane 0.20.7-r3, crane 0.20.7-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XF11487 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-MN00336 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...

CLEANSTART-2026-HI56796 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-WS51251 Security fix for GHSA-9h8m-3fm2-qjrq applied in: buildkitd 0.26.3-r1, containerd 2.1.3-r2, cosign 3.0.5-r0

GHSA-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KG96538 Security fix for GHSA-jq35-85cj-fj4p applied in: crane 0.19.2-r0

Security vulnerability affects the crane package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IQ97259 Security fix for GHSA-4vq8-7jfc-9cvp applied in: crane 0.19.2-r0

Security vulnerability affects the crane package. This issue is resolved in later releases. See references for vulnerability details...