PT-2026-42351 · Cleanstart · Tempo

Published 2026-04-15 · Updated 2026-04-15

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Multiple security vulnerabilities affect the tempo package. Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery. See references for individual vulnerability details.

Fix

Related Identifiers

CLEANSTART-2026-WA84208

Affected Products

Tempo

References · 39

• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61729 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61730 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-WA84208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61727 · Security Note