Open Source Vulnerabilities

traefik, traefik, coredns-fips

etcd is a distributed key-value store for the data of a distributed system

kyverno-policy-reporter-ui-fips, step-cli

Security fix for GHSA-3fxj-6jh8-hvhx applied in: kyverno-policy-reporter-ui-fips 2.7.2-r1, step-cli 0.28.7-r3

apache-nifi, druid-fips, druid-fips, druid-fips

In Eclipse Jetty, an HTTP URI of this form: /public;/

coredns-fips

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring

apache-nifi

Netty is a network application framework for development of protocol servers and clients

druid-fips, druid-fips, druid-fips

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

kyverno-policy-reporter-ui-fips, step-cli

Security fix for GHSA-rjr7-jggh-pgcp applied in: kyverno-policy-reporter-ui-fips 2.7.2-r1, step-cli 0.28.7-r3

druid-fips, druid-fips, druid-fips

TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e

apache-nifi, druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

apache-nifi, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

apache-nifi, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

consul, step-cli, traefik, coredns-fips, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, cosign-fips, nats-server-config-reloader-fips

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

druid-fips, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi

Security fix for GHSA-f2wh-grmh-r6jm applied in: apache-nifi 2.9.0-r2

druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi

Security fix for GHSA-8297-v2rf-2p32 applied in: apache-nifi 2.9.0-r2

apache-nifi, druid-fips, druid-fips, druid-fips

Netty is a network application framework for development of protocol servers and clients

apache-nifi

Security fix for GHSA-995c-6rp3-4m4x applied in: apache-nifi 2.9.0-r2

consul, etcd, step-cli, traefik, coredns-fips, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, cosign-fips, nats-server-config-reloader-fips

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

apache-nifi

Security fix for GHSA-vf5j-865m-mq7c applied in: apache-nifi 2.9.0-r2

druid-fips, druid-fips, druid-fips

Netty is an asynchronous, event-driven network application framework

apache-nifi

fix for CVE-2026-41635 was not applied to the 2

consul, etcd, step-cli, traefik, coredns-fips, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, cosign-fips, nats-server-config-reloader-fips

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

druid-fips, druid-fips, druid-fips

RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

apache-nifi

fix for CVE-2026-41409 was not applied to the 2

apache-nifi

Apache MINA's AbstractIoBuffer

druid-fips, druid-fips, druid-fips

RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

apache-nifi

fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer

druid-fips, druid-fips, druid-fips

RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

apache-nifi

Security fix for GHSA-97jf-46m3-8953 applied in: apache-nifi 2.9.0-r2

druid-fips

Security fix for GHSA-mhm7-754m-9p8w applied in: druid-fips 34.0.0-r4

apache-nifi

Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly

apache-nifi

Deserialization of untrusted data vulnerability in QOS

apache-nifi, druid-fips

Security fix for GHSA-72hv-8253-57qq applied in: apache-nifi 2.9.0-r3, druid-fips 34.0.0-r4

apache-nifi

In Eclipse Parsson published Maven Central artifacts before version 1

consul, etcd, step-cli, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, coredns-fips, cosign-fips, nats-server-config-reloader-fips

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

apache-nifi

Apache NiFi 0

apache-nifi

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X

druid-fips

Rhino is an open-source implementation of JavaScript written entirely in Java

apache-nifi

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java

druid-fips

Out-of-bounds memory operations in org

openstack-keystone-2026.1-fips

openstack-keystone-2026.1-fips

apache-nifi

Apache NiFi 1

openstack-keystone-2026.1-fips

openstack-keystone-2026.1-fips

consul, etcd, step-cli, traefik, cosign-fips, cosign-fips, cosign-fips, cosign-fips, etcd, kyverno-policy-reporter-ui-fips, coredns-fips, cosign-fips, nats-server-config-reloader-fips

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS