CLEANSTART-2026-ZW37731 vulnerability has been identified in Node

Security vulnerability affects the apache-superset package. A vulnerability has been identified in Node...

CLEANSTART-2026-KY64095 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-TF09981 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-FN35430 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function

Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function...

CLEANSTART-2026-MI22504 flaw in Node

Security vulnerability affects the apache-superset package. A flaw in Node...

CLEANSTART-2026-GV36005 We have identified a bug in Node

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-QE83789 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-MZ33445 When audit logging is enabled (zookeeper

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

CLEANSTART-2026-VR96593 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

CLEANSTART-2026-ML04549 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-HS17717 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-JC43217 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the apache-hive package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

CLEANSTART-2026-YN41310 PAC4J is vulnerable to LDAP Injection in multiple methods

Security vulnerability affects the apache-hive package. PAC4J is vulnerable to LDAP Injection in multiple methods...

CLEANSTART-2026-JK79354 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-FB75379 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns

Security vulnerability affects the apache-hive package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...

CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-XM34051 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

CLEANSTART-2026-YG17751 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-KU24747 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CLEANSTART-2026-TS74004 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-ZQ00581 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-DD02110 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-XY63591 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-CJ18873 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-SQ92018 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

CLEANSTART-2026-KK34525 security issue was found in Netplex Json-smart 2

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

CLEANSTART-2026-PT41131 Out-of-bounds memory operations in org

CVE-2025-12183 affects multiple packages. Out-of-bounds memory operations in org. See references for individual vulnerability details...

CLEANSTART-2026-YX36075 Security fix for GHSA-8423-8fgw-73vq applied in: airflow-3 3.2.1-r10, airflow-3 3.3.0-r7

GHSA-8423-8fgw-73vq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RK84502 Security fix for GHSA-wwv5-g3v4-889x applied in: airflow-3 3.2.1-r10, airflow-3 3.3.0-r7

GHSA-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IA02205 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

CVE-2026-85999 affects multiple packages. Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. See references for individual vulnerability details...

CLEANSTART-2026-WT17870 denial-of-service (DoS) vulnerability exists in google

CVE-2026-0994 affects multiple packages. A denial-of-service DoS vulnerability exists in google. See references for individual vulnerability details...

CLEANSTART-2026-HN56879 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-64847 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-MR36651 Vitest is a testing framework powered by Vite

Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...

CLEANSTART-2026-KA42623 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Security vulnerability affects the airflow-3 package. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio...

CLEANSTART-2026-YC00032 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

CVE-2026-86000 affects multiple packages. Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. See references for individual vulnerability details...

CLEANSTART-2026-YH72790 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-63374 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-KE27596 js-yaml is a JavaScript YAML parser and dumper

CVE-2026-84375 affects multiple packages. js-yaml is a JavaScript YAML parser and dumper. See references for individual vulnerability details...

CLEANSTART-2026-PP78809 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-KE95640 JLine is a Java library for handling console input

CVE-2026-77420 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...

CLEANSTART-2026-HJ08355 Netty is an asynchronous, event-driven network application framework

CVE-2026-59903 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-SC57620 Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1

Security vulnerability affects the elasticsearch package. Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1...

CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...

CLEANSTART-2026-FZ84712 Netty is an asynchronous, event-driven network application framework

CVE-2026-75595 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...