Vulnerabilidades

Vulnerabilidades críticas que el gate ya conoce.

Cada seis horas Attestkeep descarga la Trivy vulnerability database, la misma que el scanner lee dentro de su cluster. Estas son las entradas que la database calificó como críticas esta semana, y cuándo. No cuándo salió la noticia: cuándo lo supo el gate.

IDVulnerabilidadCalificada desdePublicada
CVE-2026-98904
media
kernel: mailbox: imx: Use devm_pm_runtime_enable()build de las 19:17 UTC
CVE-2026-114610
media
fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fp ...build de las 19:17 UTC
CVE-2026-114609
media
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's sh ...build de las 19:17 UTC
CVE-2026-108360
media
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingbuild de las 19:17 UTC
CVE-2026-114501
media
pillow: Pillow: Information disclosure via improper memory alignment during Arrow exportbuild de las 19:17 UTC
CVE-2026-96643
media
pillow: pillow: Denial of Service via repeated EXIF headersbuild de las 19:17 UTC
CVE-2026-112897
media
pillow: pillow: Information disclosure via uninitialized buffer in TIFF decodingbuild de las 19:17 UTC
CVE-2026-106414
media
chromium-browser: Improper input validation in Mobilebuild de las 19:17 UTC
CVE-2026-103288
media
Ghost: Authorization Bypass in Comment Like Featurebuild de las 19:17 UTC
CVE-2026-94545
media
Satori-generated SVG has improper escapingbuild de las 19:17 UTC
CVE-2026-98148
media
kernel: drm/gud: validate GUD_ROTATION_0 is present in supported rotationsbuild de las 19:17 UTC
CVE-2026-98147
media
kernel: printk: Don't WARN on kthread_run failurebuild de las 19:17 UTC
CVE-2026-60083
media
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesbuild de las 19:17 UTC
CVE-2026-72207
media
kernel: ntfs: not change 0-byte $DATA attribute to non-residentbuild de las 19:17 UTC
CVE-2026-64601
media
kernel: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmissionbuild de las 19:17 UTC
CVE-2026-64580
media
kernel: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()build de las 19:17 UTC
CVE-2024-8928
media
Amazon Linux 2023 - ALAS2023-2025-845: Medium priority package update for php8.1build de las 19:17 UTC
SUSE-SU-2026:4906-1
media
Security update for krb5build de las 19:17 UTC
openSUSE-SU-2026:12267-1
media
amazon-cloudwatch-agent-1.300073.2-2.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12269-1
media
dlib-devel-20.0.1-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12270-1
media
flannel-0.28.10-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12272-1
media
liblldpctl4-1.0.23-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12273-1
media
benchdnn-3.14-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12274-1
media
libonnxruntime1-1.31.0-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12275-1
media
perl-Plack-1.0057-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12276-1
media
perl-Starman-0.4019-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12277-1
media
python313-djangorestframework-3.18.2-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12278-1
media
python313-fpdf2-2.8.9-2.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12279-1
media
python313-langgraph-sdk-0.4.9-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12280-1
media
python313-nltk-3.10.4-1.1 on GA mediabuild de las 19:17 UTC
openSUSE-SU-2026:12281-1
media
traefik-3.7.16-1.1 on GA mediabuild de las 19:17 UTC
CVE-2026-107080
media
openjpeg2: openjpeg2: Denial of Service via out-of-bounds memory access in opj_dwt_encode_and_deinterleave_vbuild de las 07:13 UTC
CVE-2026-92171
media
infinispan-operator: Infinispan Operator: Sensitive information disclosure due pod args storebuild de las 07:13 UTC
CVE-2026-116497
media
gssproxy: gssproxy: NULL pointer dereference in GSSX_INIT_SEC_CONTEXT crashes daemonbuild de las 07:13 UTC
CVE-2026-116262
media
libimobiledevice: libimobiledevice: Denial of Service via heap-based buffer overflow in Web Inspectorbuild de las 07:13 UTC
CVE-2026-115718
media
builder: Frappe Builder: Unauthorized resource consumption via missing authorization in improve_promptbuild de las 07:13 UTC
CVE-2026-115717
media
builder: builder: Information disclosure via Server-Side Request Forgery in convert_to_webpbuild de las 07:13 UTC
CVE-2026-99082
media
kernel: KVM: x86: Use active memslots for the per-vCPU MMIO cachebuild de las 07:13 UTC
CVE-2026-99081
media
kernel: bnxt_en: fix DMA mapping length for padded small packetsbuild de las 07:13 UTC
CVE-2026-99079
media
kernel: net/mlx5e: Prevent stale XSK buffer release on refill retrybuild de las 07:13 UTC
CVE-2026-99074
media
kernel: ipv4: stop PMTU walk when nexthop group shrinksbuild de las 07:13 UTC
CVE-2026-99073
media
kernel: ipv4: stop exception dump when nexthop group shrinksbuild de las 07:13 UTC
CVE-2026-98903
media
kernel: mailbox: imx: Add a channel shutdown fieldbuild de las 07:13 UTC
CVE-2026-98902
media
kernel: md/raid5: let stripe batch bm_seq comparison wrap-safebuild de las 07:13 UTC
CVE-2026-98900
media
kernel: xen/gntalloc: validate grant count before allocationbuild de las 07:13 UTC
CVE-2026-98898
media
kernel: drm/amd/pm/si: Don't schedule thermal work when queue isn't initializedbuild de las 07:13 UTC
CVE-2026-98897
media
kernel: ksmbd: don't hold ci->m_lock while waiting for a lease break ackbuild de las 07:13 UTC
CVE-2026-98896
media
kernel: thunderbolt: Keep the domain reference while processing hotplugbuild de las 07:13 UTC
CVE-2026-98895
media
kernel: net/mlx5: HWS, Handle destroying table that has a miss tablebuild de las 07:13 UTC
CVE-2026-98894
media
kernel: drm/amd/ras: reset CPER ring on corrupt entry sizebuild de las 07:13 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.