Vulnerabilidades

Vulnerabilidades críticas que el gate ya conoce.

Cada seis horas Attestkeep descarga la Trivy vulnerability database, la misma que el scanner lee dentro de su cluster. Estas son las entradas que la database calificó como críticas esta semana, y cuándo. No cuándo salió la noticia: cuándo lo supo el gate.

IDVulnerabilidadCalificada desdePublicada
CVE-2026-101333
media
keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpointbuild de las 07:11 UTC
CVE-2026-19444
media
k8s.io/kubectl: Kubernetes kubectl: Arbitrary file write via path traversal on Windowsbuild de las 07:11 UTC
CVE-2026-94287
media
libXpm: libXpm: Denial of Service via unsigned integer underflowbuild de las 07:11 UTC
CVE-2026-94285
media
libX11: libX11: Denial of Service via out-of-bounds read in byte-oriented codeset parserbuild de las 07:11 UTC
CVE-2026-94284
media
libX11: libX11: Denial of Service via out-of-bounds read in XIM trigger-key registration parserbuild de las 07:11 UTC
CVE-2026-94283
media
libX11: libX11: Denial of Service via out-of-bounds read in XIM attribute parserbuild de las 07:11 UTC
CVE-2026-94282
media
libXi: libXi: Denial of Service via out-of-bounds read in XI2 event processingbuild de las 07:11 UTC
CVE-2026-101017
media
opendmarc: OpenDMARC: Denial of Service via NULL pointer dereference during subdomain walking in opendmarc_policy.cbuild de las 07:11 UTC
CVE-2026-101016
media
opendmarc: OpenDMARC: Improper policy enforcement via malformed DMARC record tagsbuild de las 07:11 UTC
CVE-2026-101003
media
mongoose: mongoose: Denial of Service via stack-based buffer overflow in MQTT brokerbuild de las 07:11 UTC
CVE-2026-96281
media
flatpak: flatpak: Unprivileged active user can bypass anti-downgrade checks for system apps/runtimesbuild de las 07:11 UTC
CVE-2026-96280
media
flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systemsbuild de las 07:11 UTC
CVE-2026-96279
media
flatpak: flatpak: Path traversal issue in OCI archive extraction via hardlinksbuild de las 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.