11796 matches found
CLEANSTART-2026-GN07707 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the minio-operator package. Previously, resolving relative paths containing parent directory '...
CLEANSTART-2026-DE66798 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the minio-operator package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-DB44167 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...
Security vulnerability affects the minio-operator package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...
CLEANSTART-2026-TO10251 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Security vulnerability affects the minio-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...
CLEANSTART-2026-WR28869 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default
Security vulnerability affects the minio-operator package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default...
CLEANSTART-2026-HJ64426 gRPC-Go is the Go language implementation of gRPC
Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...
CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings
Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...
CLEANSTART-2026-BY71452 gRPC-Go is the Go language implementation of gRPC
Security vulnerability affects the tempo package. gRPC-Go is the Go language implementation of gRPC...
CLEANSTART-2026-WR14423 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...
Security vulnerability affects the langfuse package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...
CLEANSTART-2026-WI13010 undici's dump interceptor reads and discards a response body up to a configurable maximum size
Security vulnerability affects the langfuse package. undici's dump interceptor reads and discards a response body up to a configurable maximum size...
CLEANSTART-2026-RF59492 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
Security vulnerability affects the langfuse package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers...
CLEANSTART-2026-KI47469 ### Summary `qs
Security vulnerability affects the langfuse package. Summary qs...
CLEANSTART-2026-CJ83222 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response
Security vulnerability affects the langfuse package. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response...
CLEANSTART-2026-AH89272 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...
Security vulnerability affects the langfuse package. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never...
CLEANSTART-2026-MU53391 ### Summary When `qs
Security vulnerability affects the langfuse package. Summary When qs...
CLEANSTART-2026-CL40927 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
Security vulnerability affects the langfuse package. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header...
CLEANSTART-2026-TI91814 undici's retry handler can leave an already-exposed response body pending forever
Security vulnerability affects the langfuse package. undici's retry handler can leave an already-exposed response body pending forever...
CLEANSTART-2026-FK35606 undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1
Security vulnerability affects the langfuse package. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1...
CLEANSTART-2026-US73537 undici's setCookie function does not fully sanitize cookie attributes
Security vulnerability affects the langfuse package. undici's setCookie function does not fully sanitize cookie attributes...
CLEANSTART-2026-MX71943 Security fix for GHSA-cc9r-2j5m-2m83 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-QL18183 Security fix for GHSA-2x7j-588g-ccc2 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-MI57025 Security fix for GHSA-8m3c-c648-2xjj applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-EW00525 Security fix for GHSA-wmmp-3585-3rmp applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-XL00241 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...
CLEANSTART-2026-UO74243 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-EK03411 fast-uri before 4
Security vulnerability affects the langfuse package. fast-uri before 4...
CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...
CLEANSTART-2026-ZY12459 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...
CLEANSTART-2026-LZ46216 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-BZ98480 undici's experimental WebSocketStream client crashes the whole Node
Security vulnerability affects the langfuse package. undici's experimental WebSocketStream client crashes the whole Node...
CLEANSTART-2026-SR09955 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-OS54288 fast-uri is a URI parser for Node
Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...
CLEANSTART-2026-CC59685 fast-uri serializes the port component of a URI without validating it
Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...
CLEANSTART-2026-TL07655 Security fix for GHSA-f4xh-w4cj-qxq8 applied in: langfuse 3.225.9-r1
Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-IF81553 undici's WebSocket client crashes the whole Node
Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...
CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON
Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...
CLEANSTART-2026-XW95459 Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities
Security vulnerability affects the apache-superset package. Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities...
CLEANSTART-2026-QW09673 Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities
Security vulnerability affects the apache-superset package. Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities...
CLEANSTART-2026-PD89526 Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification
Security vulnerability affects the apache-superset package. Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification...
CLEANSTART-2026-VT26108 memory leak occurs in Node
Security vulnerability affects the apache-superset package. A memory leak occurs in Node...
CLEANSTART-2026-UO45080 Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities
Security vulnerability affects the apache-superset package. Rejected reason: This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities...
CLEANSTART-2026-NP94260 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-OM37971 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-JO53720 incomplete fix for CVE-2024-36137 leaves `FileHandle
Security vulnerability affects the apache-superset package. An incomplete fix for CVE-2024-36137 leaves FileHandle...
CLEANSTART-2026-DI68809 memory leak in Node
Security vulnerability affects the apache-superset package. A memory leak in Node...
CLEANSTART-2026-JU79609 Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file
Security vulnerability affects the apache-superset package. Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file...
CLEANSTART-2026-NZ34356 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-NF20161 flaw in Node
Security vulnerability affects the apache-superset package. A flaw in Node...
CLEANSTART-2026-UP28744 malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
CLEANSTART-2026-FN35430 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function
Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function...