Schwachstellen
Kritische Schwachstellen, die das Gate schon kennt.
Alle sechs Stunden holt Attestkeep die Trivy Vulnerability Database, dieselbe, die der Scanner in Ihrem Cluster liest. Das sind die Einträge, die die Database diese Woche als kritisch eingestuft hat, und wann. Nicht, wann die Nachricht kam: wann das Gate es wusste.
Database zuletzt aktualisiert27. Okt. 2026, 13:12 UTC
23kritisch, letzte 7 Tage298hoch, letzte 7 Tage633mittel, letzte 7 Tage139niedrig, letzte 7 Tage| ID | Schwachstelle | Quelle der Einstufung / Ökosysteme | Kritisch seit | Veröffentlicht |
|---|---|---|---|---|
| CVE-2026-107282 kritisch | org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostasync-http-client, org.asynchttpclient:async-http-client, druid und 6 weitere | GHSA, Red HatGHSA 9.4chainguard, seal maven, debian, minimos, rapidfort debian +4 | Build 07:11 UTC | |
| CVE-2026-62253 kritisch | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)github.com/sipcapture/homer-app | GHSAGHSA 9.8go | Build 07:11 UTC | |
| CVE-2026-62252 kritisch | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Logingithub.com/sipcapture/homer-app | GHSAGHSA 9.8go | Build 07:11 UTC | |
| CVE-2026-62176 kritisch | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generationpraisonai | GHSAGHSA 9.1pip | Build 07:11 UTC | |
| CVE-2026-92414 kritisch | : Session Fixation / Session Reuse across Users vulnerability in Apach ...jackrabbit | NVDNVD 9.1debian, rapidfort debian, echo | Build 07:11 UTC | |
| CVE-2026-105192 kritisch | LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportkserve-huggingfaceserver-cuda-13.3, lmcache, lmcache-cuda-13.0 | GHSAGHSA 9.8chainguard, pip | Build 07:11 UTC | |
| CVE-2026-81535 kritisch | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel…wolfssh | NVDNVD 9.1alpine | Build 07:11 UTC | |
| CVE-2026-106486 kritisch | plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server | NVDNVD 9.9npm | Build 07:11 UTC | |
| CVE-2026-95106 kritisch | Gitea review and execution mismatch through duplicate tree entriesgitea, gitea-fips | BitnamiBitnami 9.1rapidfort alpine, minimos, bitnami | Build 07:11 UTC | |
| CVE-2026-73278 kritisch | Gitea WebAuthn bypass during OAuth and OIDC sign-ingitea, gitea-fips | BitnamiBitnami 9.8rapidfort alpine, minimos, alpine, bitnami | Build 07:11 UTC | |
| CVE-2026-106237 kritisch | chromium-browser: Information leak in Permissionschromium, chromedriver, chromium-common und 3 weitere | NVDNVD 9.6rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | Build 07:11 UTC | |
| CVE-2026-106195 kritisch | chromium-browser: Incorrect authorization in Chromotingchromium, chromedriver, chromium-common und 3 weitere | NVDNVD 9.1rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | Build 07:11 UTC | |
| CVE-2026-106102 kritisch | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasar | GHSAGHSA 10.0npm | Build 07:11 UTC | |
| CVE-2026-105863 kritisch | Payload authentication token field handling issuepayload | NVD, GHSANVD 9.4npm | Build 07:11 UTC | |
| CVE-2026-105859 kritisch | Payload: Unauthorized update to collection documentspayload | GHSAGHSA 9.8npm | Build 07:11 UTC | |
| CVE-2026-105857 kritisch | Payload Form Builder has an RCE issue@payloadcms/plugin-form-builder | GHSAGHSA 10.0npm | Build 07:11 UTC | |
| CVE-2026-105848 kritisch | Payload: Insufficient Access Control in Stripe REST Proxy@payloadcms/plugin-stripe | NVDNVD 9.6npm | Build 07:11 UTC | |
| CVE-2026-105845 kritisch | Payload: SQL Injection in SQLite and Postgrespayload | GHSAGHSA 9.8npm | Build 07:11 UTC | |
| CVE-2026-105844 kritisch | Payload: Prototype pollution in Payload Import Export plugin@payloadcms/plugin-import-export | GHSAGHSA 9.3npm | Build 07:11 UTC | |
| CVE-2026-105794 kritisch | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLMicrosoft.Native.Quic.MsQuic.OpenSSL, microsoft.native.quic.msquic.openssl | GHSAGHSA 9.1nuget | Build 07:11 UTC | |
| CVE-2026-105697 kritisch | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationlangflow, langflow-base, lfx | GHSAGHSA 10.0pip | Build 07:11 UTC | |
| GHSA-v2f8-6655-7grj kritisch | Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainvibe-trading-ai | GHSAGHSA 10.0pip | Build 07:11 UTC | |
| GHSA-jqmf-mx4f-hfr6 kritisch | Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFvibe-trading-ai | GHSAGHSA 10.0pip | Build 07:11 UTC | |
| GHSA-gg6r-gp4c-89hp kritisch | Trigger.dev: V1 coordinator default-secret unauth Socket.IOtrigger.dev | GHSAGHSA 9.2npm | Build 07:11 UTC | |
| CVE-2026-103922 kritisch | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path@capacitor/android, @capacitor/ios, com.capacitorjs:core und 1 weitere | GHSAGHSA 9.3npm, maven, swift | Build 07:11 UTC | |
| CVE-2026-101276 kritisch | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use- ...iperf3, iperf, iperf-doc | Photon OSPhoton OS, debian, rapidfort debian, alpine | Build 07:11 UTC | |
| CVE-2026-55107 kritisch | kobako Sandbox Escape - guest eval reaches host RCE via method_missing → public_send (any bound Service)kobako | GHSA, Ruby Advisory DBGHSA 10.0rubygems | Build 07:11 UTC | |
| GHSA-vcvr-r3jv-pc5j kritisch | Next.js: Remote Code Execution in next/og ImageResponsenext | GHSAGHSA 9.5echo npm, npm | Build 07:11 UTC | |
| CVE-2026-102828 kritisch | simple-git: simple-git unsafe-operation guard does not block trailer command configurationgrafana, grafana-selinux, renovate und 5 weitere | NVD, GHSANVD 9.8rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, rapidfort rocky, Red Hat +6 | Build 07:11 UTC | |
| CVE-2026-102827 kritisch | simple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)renovate, simple-git, @seal-security/simple-git und 17 weitere | NVDNVD 9.8Red Hat, chainguard, minimos, seal npm, npm +1 | Build 07:11 UTC | |
| CVE-2026-102560 kritisch | libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growthlibsoup3, libsoup, libsoup2.4 und 7 weitere | NVDNVD 9.8rapidfort ubuntu, ubuntu, rapidfort debian, debian, alma +10 | Build 07:11 UTC | |
| CVE-2026-102676 kritisch | electron: electron: Privilege escalation via unauthorized Node.js integration in web workerselectron | NVDNVD 9.8npm | Build 07:11 UTC | |
| CVE-2026-102268 kritisch | pyjwt: PyJWT: Authentication bypass via improper public key validationpyjwt, fence-agents-aliyun, fence-agents-all und 147 weitere | GHSA, Red Hat, Azure Linux, Photon OSGHSA 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +16 | Build 07:11 UTC | |
| CVE-2026-102267 kritisch | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirectspyjwt, fence-agents-aliyun, fence-agents-all und 157 weitere | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, chainguard +16 | Build 07:11 UTC | |
| CVE-2026-102266 kritisch | pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptancefence-agents-aliyun, fence-agents-all, fence-agents-aws und 142 weitere | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +15 | Build 07:11 UTC |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.