CLEANSTART-2026-YN27017 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-RR86814 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-UW01698 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-SH40578 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-LN60743 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-JF16968 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-KQ36587 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-PA97318 Security fix for GHSA-hrxh-6v49-42gf applied in: kube-state-metrics 2.19.1-r1, kube-state-metrics 2.20.0-r0, kube-state-metrics 2.18.0-r7

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FD89775 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-ZC94506 Previously, a channel registered in the mux's chanList is not usable until it is established

CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-PM29694 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-IG26427 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-CR77142 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-NI95909 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-GM47441 norm

Security vulnerability affects the kube-state-metrics package. A norm...

CLEANSTART-2026-NE14632 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-YT94569 Security fix for GHSA-8wmf-6v46-5gfg applied in: prometheus-operator 0.91.0-r7, prometheus-operator 0.92.1-r5

GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-RB27894 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

CVE-2026-85999 affects multiple packages. Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. See references for individual vulnerability details...

CLEANSTART-2026-XS44337 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-64847 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-YN00002 AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

CVE-2026-63374 affects multiple packages. AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. See references for individual vulnerability details...

CLEANSTART-2026-ZC76920 Tornado before 6

Security vulnerability affects the airflow-3 package. Tornado before 6...

CLEANSTART-2026-PS59368 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

CVE-2026-86000 affects multiple packages. Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. See references for individual vulnerability details...

CLEANSTART-2026-RR24550 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts

CVE-2026-86466 affects multiple packages. Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. See references for individual vulnerability details...

CLEANSTART-2026-NE81748 Security fix for GHSA-8423-8fgw-73vq applied in: airflow-3 3.0.6-r8, airflow-3 3.2.2-r7, airflow-3 3.1.8-r11

GHSA-8423-8fgw-73vq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FC13167 aiosmtplib before 5

CVE-2026-90467 affects multiple packages. aiosmtplib before 5. See references for individual vulnerability details...

CLEANSTART-2026-FC44731 Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation

CVE-2026-82310 affects multiple packages. Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. See references for individual vulnerability details...

CLEANSTART-2026-CX71098 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-XQ90781 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

CVE-2026-84377 affects multiple packages. LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. See references for individual vulnerability details...

CLEANSTART-2026-TQ94718 Apache Airflow FAB provider versions 3

CVE-2026-75156 affects multiple packages. Apache Airflow FAB provider versions 3. See references for individual vulnerability details...

CLEANSTART-2026-WC06247 PyAthena prior to 3

CVE-2026-65321 affects multiple packages. PyAthena prior to 3. See references for individual vulnerability details...

CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...

CLEANSTART-2026-KI90686 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

CVE-2026-62949 affects multiple packages. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. See references for individual vulnerability details...

CLEANSTART-2026-QU51579 Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions

CVE-2026-86462 affects multiple packages. Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. See references for individual vulnerability details...

CLEANSTART-2026-MS68027 Security fix for GHSA-wwv5-g3v4-889x applied in: airflow-3 3.0.6-r8, airflow-3 3.2.2-r7

GHSA-wwv5-g3v4-889x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DR99316 aiosmtplib is an asynchronous SMTP client for use with asyncio

Security vulnerability affects the airflow-3 package. aiosmtplib is an asynchronous SMTP client for use with asyncio...

CLEANSTART-2026-OZ84157 Tornado before 6

CVE-2026-91991 affects multiple packages. Tornado before 6. See references for individual vulnerability details...

CLEANSTART-2026-JQ90440 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards

Security vulnerability affects the airflow-3 package. joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards...

CLEANSTART-2026-NP36052 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"

Security vulnerability affects the airflow-3 package. Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"...

CLEANSTART-2026-PH27311 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-JF73384 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-ZF06742 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-AA29461 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-JT70619 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-YE46626 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the helm-operator package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-GZ44197 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-QM02522 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-AT83636 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-LY26617 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-FI79899 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the fluent-operator package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...