Vulnerabilidades

Vulnerabilidades críticas que el gate ya conoce.

Cada seis horas Attestkeep descarga la Trivy vulnerability database, la misma que el scanner lee dentro de su cluster. Estas son las entradas que la database calificó como críticas esta semana, y cuándo. No cuándo salió la noticia: cuándo lo supo el gate.

IDVulnerabilidadCalificada desdePublicada
CVE-2026-88815
alta
perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type castingbuild de las 07:11 UTC
CVE-2026-87114
alta
kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudobuild de las 07:11 UTC
CVE-2026-85644
alta
perl-XS-Parse-Keyword: perl-XS-Parse-Keyword: Denial of Service via improper array reference validationbuild de las 07:11 UTC
CVE-2026-101894
alta
@xhmikosr/decompress: @xhmikosr/decompress: Path traversal via symlink chainbuild de las 07:11 UTC
CVE-2026-93348
alta
unsloth-zoo: unsloth: Unsloth Zoo: Arbitrary code execution via crafted model configurationbuild de las 07:11 UTC
GHSA-456v-xq2p-r4cj
alta
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)build de las 07:11 UTC
CVE-2026-86330
alta
noobaa-core: noobaa-core: OS command injection in cluster_internal_api.set_hostname_internalbuild de las 07:11 UTC
CVE-2026-101292
alta
artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserializationbuild de las 07:11 UTC
CVE-2026-91006
alta
org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance optionsbuild de las 07:11 UTC
CVE-2026-94286
alta
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parserbuild de las 07:11 UTC
CVE-2026-101015
alta
opendmarc: OpenDMARC: DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handlerbuild de las 07:11 UTC
CVE-2026-101014
alta
opendmarc: OpenDMARC: Denial of Service via off-by-one error in opendmarc_util_cleanupbuild de las 07:11 UTC
CVE-2026-100888
alta
A weakness has been identified in Trusted Domain Project OpenDKIM up t ...build de las 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.