Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 81 available sources using the dropdown above.
Cleanstart is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| cleanstart-2026-zv78301 | SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process | 2026-10-02T00:35:56.519832Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-zl19560 | Security fix for ghsa-9h8m-3fm2-qjrq applied in: consul 1.21.5-r0, cosign 3.0.5-r0 | 2026-10-02T00:35:55.915865Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-yz71204 | authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users | 2026-10-02T00:35:54.739407Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ym37209 | Security fix for ghsa-4f99-4q7p-p3gh applied in: consul 1.20.6-r0, consul 1.21.5-r0 | 2026-10-02T00:35:55.687200Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-yf33963 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion | 2026-10-02T00:35:52.805764Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ye69312 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS | 2026-10-02T00:35:52.670106Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-xz73370 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures | 2026-10-02T00:35:52.250149Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-tz02456 | denial-of-service vulnerability exists in github | 2026-10-02T00:35:55.987828Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ts90060 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service | 2026-10-02T00:35:54.663499Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-tg08354 | html | 2026-10-02T00:35:56.443707Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-sr81075 | ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label | 2026-10-02T00:35:52.401708Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-sr06893 | Previously, a channel registered in the mux's chanList is not usable until it is established | 2026-10-02T00:35:51.653530Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-sn29666 | Previously, resolving relative paths containing parent directory (' | 2026-10-02T00:35:52.961300Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-sm16447 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface | 2026-10-02T00:35:52.538354Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-se64937 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer | 2026-10-02T00:35:52.116231Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-sd77864 | malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop | 2026-10-02T00:35:54.952982Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-rw00799 | Security fix for ghsa-f6x5-jh6r-wrfv applied in: consul 1.21.5-r0 | 2026-10-02T00:35:55.840612Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ro22308 | (*x509 | 2026-10-02T00:35:53.906031Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-rm75636 | When returning errors, functions in the net/textproto package would include its input as part of the error | 2026-10-02T00:35:53.982475Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ri83970 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree | 2026-10-02T00:35:54.292961Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-pu41775 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To... | 2026-10-02T00:35:55.535129Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-oz83684 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption | 2026-10-02T00:35:56.205754Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ny71627 | HashiCorp memberlist before version 0 | 2026-10-02T00:35:53.714368Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ny69031 | norm | 2026-10-02T00:35:53.256055Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ns73897 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree | 2026-10-02T00:35:54.443632Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-nn31666 | OpenTelemetry-Go is the Go implementation of OpenTelemetry | 2026-10-02T00:35:56.060208Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-ng02064 | RSA and DSA public key parsers did not enforce size limits on key parameters | 2026-10-02T00:35:54.811057Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-mv50731 | When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa... | 2026-10-02T00:35:55.238007Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-mt59352 | source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2... | 2026-10-02T00:35:51.780523Z | 2026-10-01T12:15:40Z |
| cleanstart-2026-mp17411 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou... | 2026-10-02T00:35:55.384944Z | 2026-10-01T12:15:40Z |