Vulnérabilités
Les vulnérabilités critiques que le gate connaît déjà.
Toutes les six heures, Attestkeep récupère la Trivy vulnerability database, celle que le scanner lit dans votre cluster. Voici les entrées que la database a classées critiques cette semaine, et quand. Pas quand la nouvelle est tombée : quand le gate l'a su.
Dernière mise à jour de la database27 oct. 2026, 13:12 UTC
23critique, 7 derniers jours298élevée, 7 derniers jours633moyenne, 7 derniers jours139faible, 7 derniers jours| ID | Vulnérabilité | Source de la sévérité / écosystèmes | Critique depuis | Publiée |
|---|---|---|---|---|
| CVE-2026-99083 critique | kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()linux | Red HatRed Hat 9.8debian, echo | build de 07:13 UTC | |
| GHSA-xgh2-jgvm-8g78 critique | Unsigned ID tokens (alg none) accepted, allowing authentication bypass in the id_token flowomniauth_oidc | Ruby Advisory DBrubygems | build de 19:14 UTC | |
| CVE-2026-99078 critique | In the Linux kernel, the following vulnerability has been resolved: n ...linux, bpftool, kernel6.12 et 7 autres | Photon OSPhoton OS, debian, rapidfort amazon linux | build de 19:10 UTC | |
| CVE-2026-98959 critique | In the Linux kernel, the following vulnerability has been resolved: b ...linux, bpftool, kernel6.12 et 7 autres | Photon OSPhoton OS, debian, rapidfort amazon linux, echo | build de 19:10 UTC | |
| CVE-2026-115889 critique | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, th ...rust-wasmtime, wasmtime | GHSAGHSA 10.0debian, rapidfort debian, cargo, echo | build de 07:11 UTC | |
| GHSA-cxf3-9h37-7rr8 critique | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsgithub.com/labstack/echo/v4, github.com/labstack/echo/v5 | GHSAGHSA 9.1go | build de 07:11 UTC | |
| CVE-2026-57116 critique | PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocationpraisonai | GHSAGHSA 9.8pip | build de 07:11 UTC | |
| CVE-2026-114612 critique | litellm: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Red HatRed Hat 8.8 | build de 07:11 UTC | |
| CVE-2026-97631 critique | edk2: Pre-boot RCE in EDK II PXE driveredk2, edk2-tools, edk2-aarch64 et 4 autres | Red HatRed Hat 8.8rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, rapidfort fedora +4 | build de 07:11 UTC | |
| GHSA-673q-mjm6-r5xr critique | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysnext, @seal-security/next | GHSAGHSA 9.5seal npm, echo npm, npm | build de 07:11 UTC | |
| GHSA-cg2g-xh64-v4q7 critique | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesdompurify, @seal-security/dompurify | GHSAGHSA 9.2seal npm, echo npm, npm | build de 07:11 UTC | |
| GHSA-2464-fhr4-w9xw critique | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usednext, @seal-security/next | GHSAGHSA 9.5seal npm, echo npm, npm | build de 07:11 UTC | |
| GHSA-9v8h-qqgm-4m35 critique | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packagebrotli, brotlicffi | GHSAGHSA 9.2pip | build de 07:11 UTC | |
| CVE-2026-115324 critique | mem0ai Databricks vector store vulnerable to SQL injectionmem0ai | GHSAGHSA 9.2pip | build de 07:11 UTC | |
| CVE-2026-91403 critique | OpenJDK: Distrust eMudhra intermediate CA certificates due to security concernsjava-21-openjdk, java-21-openjdk-devel, java-21-openjdk-headless et 140 autres | Red HatRed Hat 6.8rapidfort alma, Red Hat, amazon linux, rapidfort amazon linux, rapidfort Red Hat +4 | build de 07:11 UTC | |
| CVE-2026-114509 critique | Laravel TokenGuard authentication bypass through non-string API credentialslaravel/framework | GHSAGHSA 9.2composer | build de 07:11 UTC | |
| CVE-2026-96639 critique | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-fr ...pillow, nemo-gym, nemo-rl-cuda-13.0 et 3 autres | GHSAGHSA 9.8chainguard, debian, rapidfort debian, echo, echo pip +1 | build de 07:11 UTC | |
| CVE-2026-114406 critique | ca-certificates: Distrust eMudhra intermediate CA certificates due to security concernsca-certificates, rf-ca-certificates, openshift/ose-rhel-coreos-8 et 1 autres | Red Hat, AlmaLinux, Oracle, Rocky LinuxRed Hat 6.8rapidfort rocky, Red Hat, alma, rocky, Oracle Linux +4 | build de 07:11 UTC | |
| CVE-2026-114139 critique | Sentry-Javascript: Middleware Bypass when using Tunnel route@sentry/nextjs, langfuse-3, langfuse-4 et 3 autres | GHSAGHSA 9.1chainguard, echo npm, npm, wolfi | build de 07:11 UTC | |
| CVE-2026-109618 critique | php: OOM bailout during request parsing leads to memory corruption and RCEphp, php-bcmath, php-cli et 529 autres | NVD, Azure Linux, Bitnami, UbuntuNVD 9.8alma, amazon linux, rocky, rapidfort amazon linux, rapidfort alma +16 | build de 07:11 UTC | |
| CVE-2026-71195 critique | manila: manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writesmanila, openstack-manila, openstack-manila-share et 3 autres | Red HatRed Hat 8.8Red Hat, debian, rapidfort debian, echo | build de 07:11 UTC | |
| GHSA-hq85-5cpj-mr62 critique | uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromiseduv, python3-uv | GHSAGHSA 9.1rapidfort alpine, rapidfort Oracle Linux, rapidfort fedora, pip | build de 07:11 UTC | |
| GHSA-6q48-6c7w-9gw2 critique | certifi bundles emSign root CAs with compromised intermediate CA keyspython3-certifi, certifi, python-certifi | GHSAGHSA 9.1rapidfort fedora, rapidfort Oracle Linux, echo pip, pip | build de 07:11 UTC | |
| CVE-2026-112900 critique | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is ...pillow, open-webui, py3-pillow et 9 autres | GHSA, BitnamiGHSA 9.2chainguard, debian, rapidfort debian, seal pip, wolfi +5 | build de 07:11 UTC | |
| CVE-2026-112403 critique | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ...pillow, gftools, kserve et 29 autres | GHSA, BitnamiGHSA 9.2chainguard, wolfi, debian, rapidfort debian, seal pip +4 | build de 07:11 UTC | |
| CVE-2026-112398 critique | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ...pillow, nemo-skills, python-pillow et 1 autres | GHSA, BitnamiGHSA 9.2debian, rapidfort debian, seal pip, bitnami, chainguard +4 | build de 07:11 UTC | |
| CVE-2026-112393 critique | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow ha ...pillow, open-webui, py3-pillow et 9 autres | NVD, GHSA, BitnamiNVD 9.8chainguard, debian, rapidfort debian, seal pip, wolfi +5 | build de 07:11 UTC | |
| CVE-2026-111058 critique | Mercury: Unauthenticated Remote Code Execution via /api/kernelsmercury | GHSAGHSA 9.8pip | build de 07:11 UTC | |
| CVE-2026-111057 critique | Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmercury | GHSAGHSA 10.0pip | build de 07:11 UTC | |
| CVE-2026-96620 critique | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Executionclaude-agent-sdk | GHSAGHSA 9.2pip | build de 07:11 UTC | |
| CVE-2026-111375 critique | freerdp: FreeRDP: Denial of Service via out-of-bounds read in RAIL window titlefreerdp, freerdp-devel, freerdp-libs et 6 autres | NVDNVD 9.1rapidfort alma, rapidfort rocky, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat +6 | build de 07:11 UTC | |
| CVE-2026-57496 critique | netlicensing-mcp: REST Path Traversal Bypasses Token Redactionnetlicensing-mcp | GHSAGHSA 9.6pip | build de 07:11 UTC | |
| CVE-2026-109829 critique | undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect cachingnode-undici, nodejs24, nodejs24-devel et 47 autres | NVDNVD 9.1Red Hat, rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, amazon linux +7 | build de 07:11 UTC | |
| CVE-2026-109383 critique | undici: undici: Certificate validation bypass via dropped TLS options in Agentnode-undici, nodejs24, nodejs24-devel et 57 autres | NVDNVD 9.1Red Hat, amazon linux, rapidfort amazon linux, rapidfort Oracle Linux, rapidfort Red Hat +7 | build de 07:11 UTC | |
| CVE-2026-110858 critique | GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspecpython-git, gitpython, python-gitpython et 4 autres | Red HatRed Hat 8.1Red Hat, debian, rapidfort debian, seal pip, echo | build de 07:11 UTC | |
| CVE-2026-102748 critique | Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Servicegithub.com/dgraph-io/dgraph/v25 | GHSAGHSA 9.2go | build de 07:11 UTC | |
| CVE-2026-73802 critique | gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledgitea, gitea-fips, gitea.com/gitea/runner | GHSAGHSA 10.0minimos, go | build de 07:11 UTC | |
| CVE-2026-104252 critique | Vitess vttablet /twopcz reflected XSSvitess.io/vitess | GHSAGHSA 9.8go | build de 07:11 UTC | |
| CVE-2026-88092 critique | dotnet: ASP.NET Core Tampering Vulnerabilitydotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0 et 93 autres | GHSA, Red Hat, AlmaLinux, Amazon, Bitnami, Oracle, Rocky LinuxGHSA 9.4alma, rocky, rapidfort alma, Oracle Linux, amazon linux +9 | build de 07:11 UTC | |
| CVE-2026-70188 critique | dotnet: ASP.NET Core Security Feature Bypass Vulnerabilitydotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0 et 92 autres | GHSA, Red Hat, AlmaLinux, Amazon, Oracle, Rocky LinuxGHSA 9.1alma, rocky, rapidfort alma, Oracle Linux, amazon linux +8 | build de 07:11 UTC | |
| CVE-2026-105016 critique | Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerabilitydotnet8-runtime, dotnet9-runtime, dotnet10-runtime et 20 autres | GHSAGHSA 9.8rapidfort fedora, alpine, nuget | build de 07:11 UTC | |
| CVE-2026-92892 critique | github.com/jfrog/jfrog-cli: Potential command execution on the host running JFrog CLI. | Red HatRed Hat 9.0 | build de 07:11 UTC | |
| CVE-2026-102989 critique | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses@tanstack/react-start, @tanstack/solid-start, @tanstack/start-server-core et 1 autres | GHSAGHSA 9.3npm | build de 07:11 UTC | |
| CVE-2026-97229 critique | ruby: integer overflow issue in CI/CD regular expression compilerruby, ruby-devel, ruby-libs et 46 autres | Red Hat, BitnamiBitnami 10.0rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, rapidfort rocky, minimos +9 | build de 07:11 UTC | |
| CVE-2026-57118 critique | PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointspraisonaiagents | GHSAGHSA 9.8pip | build de 07:11 UTC | |
| CVE-2026-77366 critique | obsidian-tc tokens can access arbitrary configured vaultsobsidian-tc | GHSAGHSA 10.0npm | build de 07:11 UTC | |
| CVE-2026-77363 critique | obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopbackobsidian-tc | GHSAGHSA 9.7npm | build de 07:11 UTC | |
| CVE-2026-108261 critique | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment@tinacms/app, tinacms | GHSAGHSA 9.3npm | build de 07:11 UTC | |
| CVE-2026-107845 critique | Contao: Cross-site scripting in the comments bundlecontao/comments-bundle | GHSAGHSA 9.3composer | build de 07:11 UTC | |
| CVE-2026-107722 critique | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionfast-jwt | GHSAGHSA 9.8npm | build de 07:11 UTC |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.