CLEANSTART-2026-QU13613 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CLEANSTART-2026-TI06135 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the grafana-alloy package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-RN11607 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-EC67398 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-RA21458 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-WI37742 Security fix for GHSA-hrxh-6v49-42gf applied in: grafana-alloy 1.16.3-r1

Security vulnerability affects the grafana-alloy package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SG37832 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-WU84051 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-LY29111 DataRow

Security vulnerability affects the grafana-alloy package. The DataRow...

CLEANSTART-2026-LK90655 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

CLEANSTART-2026-JI49004 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-JB79169 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the grafana-alloy package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-XW68310 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages

Security vulnerability affects the grafana-alloy package. OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages...

CLEANSTART-2026-MY24201 pgx is a PostgreSQL driver and toolkit for Go

Security vulnerability affects the grafana-alloy package. pgx is a PostgreSQL driver and toolkit for Go...

CLEANSTART-2026-DT37851 In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials

Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...

CLEANSTART-2026-ZC51583 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

CLEANSTART-2026-PK97624 Netty (io

Security vulnerability affects the elasticsearch package. Netty io...

CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

CLEANSTART-2026-WT61032 jsoup through 1

Security vulnerability affects the elasticsearch package. jsoup through 1...

CLEANSTART-2026-GU46395 Netty (io

Security vulnerability affects the elasticsearch package. Netty io...

CLEANSTART-2026-DB50494 vulnerability occurs when a client sends HTTP/1

Security vulnerability affects the elasticsearch package. The vulnerability occurs when a client sends HTTP/1...

CLEANSTART-2026-CR94528 Security fix for GHSA-j288-q9x7-2f5v applied in: elasticsearch 9.2.8-r6

Security vulnerability affects the elasticsearch package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QV47871 Security fix for GHSA-4q2v-9p7v-3v22 applied in: elasticsearch 9.2.8-r6

Security vulnerability affects the elasticsearch package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CK84592 Uncontrolled Recursion vulnerability in Apache Commons Lang

Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

CLEANSTART-2026-CQ96086 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials

Security vulnerability affects the elasticsearch package. In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials...

CLEANSTART-2026-WG08246 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-WU74095 hpack is an HTTP/2 Header Encoding for Python

Security vulnerability affects the airflow-3 package. hpack is an HTTP/2 Header Encoding for Python...

CLEANSTART-2026-DL97476 aiosmtplib is an asynchronous SMTP client for use with asyncio

Security vulnerability affects the airflow-3 package. aiosmtplib is an asynchronous SMTP client for use with asyncio...

CLEANSTART-2026-LF94693 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

Security vulnerability affects the airflow-3 package. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework...

CLEANSTART-2026-CP85393 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-BX32842 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-RR39735 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-OC34252 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-HQ95563 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-BP86434 Moby is an open source container framework

Security vulnerability affects the kubernetes package. Moby is an open source container framework...

CLEANSTART-2026-CP47219 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-XB82497 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-JY84269 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-GL76811 Moby is an open source container framework

Security vulnerability affects the kubernetes package. Moby is an open source container framework...

CLEANSTART-2026-BA81930 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-BJ90324 Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4

Security vulnerability affects the spark-sc212-jdk17-py311 package. Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4...

CLEANSTART-2026-MW15719 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-QD37306 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-LF32209 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-ZY02566 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-IP93838 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-WE63080 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-VO96639 Netty is a network application framework for development of protocol servers and clients

Security vulnerability affects the spark-sc212-jdk17-py311 package. Netty is a network application framework for development of protocol servers and clients...

CLEANSTART-2026-CW84944 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

Security vulnerability affects the spark-sc212-jdk17-py311 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...