Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
Cleanstart is not individually searchable yet — the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| cleanstart-2026-zx34882 | trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped | 2026-10-13T00:37:30.585687Z | 2026-10-12T10:52:26Z |
| cleanstart-2026-sa69441 | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently | 2026-10-13T00:37:29.793055Z | 2026-10-12T10:52:26Z |
| cleanstart-2026-ml70772 | When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression | 2026-10-13T00:37:30.177925Z | 2026-10-12T10:52:26Z |
| cleanstart-2026-za90599 | Security fix for CVE-2026-49265 applied in: k8s-sidecar 2.8.2-r1 | 2026-10-13T00:36:00.523187Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-yg47878 | urllib3 is an HTTP client library for Python | 2026-10-13T00:35:59.749710Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-xm81599 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers | 2026-10-13T00:36:01.105393Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-we83392 | urllib3 is an HTTP client library for Python | 2026-10-13T00:35:59.970292Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-qb58393 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages | 2026-10-13T00:36:01.174530Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-pz20042 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages | 2026-10-13T00:36:00.024160Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-pw41000 | Security fix for ghsa-6v7p-g79w-8964 applied in: k8s-sidecar 2.8.2-r1 | 2026-10-13T00:36:01.605261Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-ox34995 | urllib3 is an HTTP client library for Python | 2026-10-13T00:36:00.083008Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-jm52525 | Security fix for CVE-2026-49264 applied in: k8s-sidecar 2.8.2-r1 | 2026-10-13T00:36:01.042947Z | 2026-10-12T10:49:15Z |
| cleanstart-2026-ym59079 | Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan... | 2026-10-13T00:35:59.762190Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-ux80273 | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing | 2026-10-13T00:36:00.442844Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-rh44885 | Alertmanager handles alerts sent by client applications such as the Prometheus server | 2026-10-13T00:36:00.171721Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-ph12494 | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request | 2026-10-13T00:36:00.493921Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-dw61297 | malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW... | 2026-10-13T00:36:00.341723Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-dg38961 | OpenTelemetry-Go is the Go implementation of OpenTelemetry | 2026-10-13T00:36:00.857375Z | 2026-10-12T10:42:34Z |
| cleanstart-2026-wy73031 | HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r... | 2026-10-13T00:37:29.485160Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-vi85539 | Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes | 2026-10-13T00:37:29.186854Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-qo55945 | When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne... | 2026-10-13T00:37:29.173989Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-nz57247 | Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify... | 2026-10-13T00:37:29.363901Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-ld70674 | When http | 2026-10-13T00:37:28.781175Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-ka88072 | Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer | 2026-10-13T00:37:30.348955Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-hu64344 | On Windows, when the target of Root | 2026-10-13T00:37:29.540988Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-hc65345 | When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU | 2026-10-13T00:37:28.900185Z | 2026-10-12T07:59:03Z |
| cleanstart-2026-rx13164 | malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW... | 2026-10-11T00:36:47.416474Z | 2026-10-10T22:11:59Z |
| cleanstart-2026-iv56904 | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing | 2026-10-11T00:36:47.351190Z | 2026-10-10T22:11:59Z |
| cleanstart-2026-gi35870 | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently | 2026-10-11T00:36:47.664414Z | 2026-10-10T22:11:59Z |
| cleanstart-2026-fi20100 | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request | 2026-10-11T00:36:47.279969Z | 2026-10-10T22:11:59Z |