11796 matches found
CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...
CLEANSTART-2026-RJ45825 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Security vulnerability affects the fluent-operator package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CLEANSTART-2026-JD49945 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the fluent-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-QY50458 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-HW83607 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the fluent-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-BO10826 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Security vulnerability affects the fluent-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...
CLEANSTART-2026-JR87567 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the fluent-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-YT00725 baseline-browser-mapping 2
Security vulnerability affects the qdrant package. baseline-browser-mapping 2...
CLEANSTART-2026-HR55516 nanoid is a secure, URL-friendly, unique string ID generator for JavaScript
Security vulnerability affects the qdrant package. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript...
CLEANSTART-2026-NW83834 Browserslist is a configuration tool for sharing target browsers and Node
Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...
CLEANSTART-2026-EK72543 nanoid (Nano ID) before 5
Security vulnerability affects the qdrant package. nanoid Nano ID before 5...
CLEANSTART-2026-PJ72615 js-yaml is a JavaScript YAML parser and dumper
Security vulnerability affects the qdrant package. js-yaml is a JavaScript YAML parser and dumper...
CLEANSTART-2026-BT23660 Browserslist is a configuration tool for sharing target browsers and Node
Security vulnerability affects the qdrant package. Browserslist is a configuration tool for sharing target browsers and Node...
CLEANSTART-2026-WC95670 nanoid (Nano ID) before 3
Security vulnerability affects the qdrant package. nanoid Nano ID before 3...
CLEANSTART-2026-BX79488 Vitest is a testing framework powered by Vite
Security vulnerability affects the qdrant package. Vitest is a testing framework powered by Vite...
CLEANSTART-2026-YT03662 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-QV01130 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node
Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...
CLEANSTART-2026-SA35538 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-GP78521 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-SN90454 Previously, a channel registered in the mux's chanList is not usable until it is established
CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
CLEANSTART-2026-YH11240 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-GI74037 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-MB62550 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-TR09708 Security fix for GHSA-8wmf-6v46-5gfg applied in: rabbitmq-cluster-operator 2.21.1-r6
Security vulnerability affects the rabbitmq-cluster-operator package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-YY11796 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-UP97351 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-XR77764 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-KN43296 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-XY58931 Previously, a channel registered in the mux's chanList is not usable until it is established
CVE-2026-78662 affects multiple packages. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
CLEANSTART-2026-GJ17760 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the argo-cd package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('
CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-RI09437 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...
CLEANSTART-2026-TD63490 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Security vulnerability affects the argo-cd package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CLEANSTART-2026-OV04527 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-YI88599 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-SC24710 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Security vulnerability affects the argo-cd package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CLEANSTART-2026-YX17879 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-QZ52453 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
CLEANSTART-2026-ET86515 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-MT48554 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-FM06572 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the cortex package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-AZ15466 etcd is a distributed key-value store for the data of a distributed system
Security vulnerability affects the cortex package. etcd is a distributed key-value store for the data of a distributed system...
CLEANSTART-2026-WK22640 Caddy is an extensible server platform that uses TLS by default
Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...
CLEANSTART-2026-UL03599 Caddy is an extensible server platform that uses TLS by default
Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...
CLEANSTART-2026-IV17964 Security fix for GHSA-gx7w-56w6-g48x applied in: caddy 2.11.4-r0
Security vulnerability affects the caddy package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-DI50489 Caddy is an extensible server platform that uses TLS by default
Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...
CLEANSTART-2026-QE63753 Caddy is an extensible server platform that uses TLS by default
Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...
CLEANSTART-2026-CJ43596 Caddy is an extensible server platform that uses TLS by default
Security vulnerability affects the caddy package. Caddy is an extensible server platform that uses TLS by default...
CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap
Security vulnerability affects the apache-nifi package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...
CLEANSTART-2026-OZ64651 ftp and scp tasks of Apache Ant can download files from a remote server
CVE-2026-78254 affects multiple packages. The ftp and scp tasks of Apache Ant can download files from a remote server. See references for individual vulnerability details...