Vulnerabilidades

Vulnerabilidades críticas que el gate ya conoce.

Cada seis horas Attestkeep descarga la Trivy vulnerability database, la misma que el scanner lee dentro de su cluster. Estas son las entradas que la database calificó como críticas esta semana, y cuándo. No cuándo salió la noticia: cuándo lo supo el gate.

IDVulnerabilidadCalificada desdePublicada
CVE-2026-95308
baja
chromium-browser: Integer overflow in Metricsbuild de las 07:11 UTC
CVE-2026-95307
baja
chromium-browser: UI misrepresentation in ExtensionsMenubuild de las 07:11 UTC
CVE-2026-95305
baja
chromium-browser: UI misrepresentation in Chromotingbuild de las 07:11 UTC
CVE-2026-95296
baja
chromium-browser: Missing authorization in Corebuild de las 07:11 UTC
CVE-2026-95292
baja
chromium-browser: Incorrect authorization in Safebrowsingbuild de las 07:11 UTC
CVE-2026-95288
baja
chromium-browser: UI misrepresentation in Mobilebuild de las 07:11 UTC
CVE-2026-95285
baja
chromium-browser: Missing authorization in WebViewbuild de las 07:11 UTC
CVE-2026-95279
baja
chromium-browser: UI misrepresentation in Omniboxbuild de las 07:11 UTC
CVE-2026-95278
baja
chromium-browser: Missing authorization in WakeLockbuild de las 07:11 UTC
CVE-2026-92223
baja
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3build de las 07:11 UTC
CVE-2026-90916
baja
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3build de las 07:11 UTC
CVE-2026-35191
baja
openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accountingbuild de las 07:11 UTC
CVE-2026-35189
baja
openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processingbuild de las 07:11 UTC
CVE-2026-102601
baja
Flysystem is an open source file storage library for PHP. Prior to 3.3 ...build de las 07:11 UTC
CVE-2026-100831
baja
firefox: Use-after-free in the DOM: UI Events & Focus Handling componentbuild de las 07:11 UTC
CVE-2026-100830
baja
firefox: Mitigation bypass in the DOM: Navigation componentbuild de las 07:11 UTC
CVE-2026-100829
baja
firefox: Mitigation bypass in the DOM: Security componentbuild de las 07:11 UTC
CVE-2026-100826
baja
firefox: Denial-of-service in the Storage: StorageManager componentbuild de las 07:11 UTC
CVE-2026-100823
baja
firefox: Spoofing issue in the Downloads component in Firefox for Androidbuild de las 07:11 UTC
CVE-2026-100822
baja
firefox: Spoofing issue in the Networking: HTTP componentbuild de las 07:11 UTC
CVE-2026-4523
baja
Missing Authorization in GitLabbuild de las 07:11 UTC
CVE-2026-97027
baja
flatpak: flatpak: Denial of service via unsanitized keys in exported Desktop Entry / D-Bus Service filesbuild de las 07:11 UTC
CVE-2026-97026
baja
flatpak: flatpak: World-writable temporary child repositories in system-helper cache pathbuild de las 07:11 UTC
CVE-2026-97025
baja
flatpak: flatpak: World-readable OCI authentication token in system-helper cache pathbuild de las 07:11 UTC
CVE-2026-102279
baja
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, ...build de las 07:11 UTC
CVE-2026-101915
baja
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesbuild de las 07:11 UTC
CVE-2026-97399
baja
glibc: glibc: Denial of Service via out-of-bounds read in strncasecmpbuild de las 07:11 UTC
CVE-2026-96284
baja
flatpak: flatpak: Arbitrary read-access to files in the system-helper context via OCI symlink followingbuild de las 07:11 UTC
CVE-2026-96283
baja
flatpak: flatpak: flatpak-system-helper cross-user CancelPull orphans another user's ongoing pullbuild de las 07:11 UTC
CVE-2026-96282
baja
flatpak: flatpak: Extension metadata path traversal file existence oraclebuild de las 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.