Vulnérabilités
Les vulnérabilités critiques que le gate connaît déjà.
Toutes les six heures, Attestkeep récupère la Trivy vulnerability database, celle que le scanner lit dans votre cluster. Voici les entrées que la database a classées critiques cette semaine, et quand. Pas quand la nouvelle est tombée : quand le gate l'a su.
Dernière mise à jour de la database27 oct. 2026, 13:12 UTC
23critique, 7 derniers jours298élevée, 7 derniers jours633moyenne, 7 derniers jours139faible, 7 derniers jours| ID | Vulnérabilité | Source de la sévérité / écosystèmes | Critique depuis | Publiée |
|---|---|---|---|---|
| CVE-2026-107282 critique | org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostasync-http-client, org.asynchttpclient:async-http-client, druid et 6 autres | GHSA, Red HatGHSA 9.4chainguard, seal maven, debian, minimos, rapidfort debian +4 | build de 07:11 UTC | |
| CVE-2026-62253 critique | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)github.com/sipcapture/homer-app | GHSAGHSA 9.8go | build de 07:11 UTC | |
| CVE-2026-62252 critique | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Logingithub.com/sipcapture/homer-app | GHSAGHSA 9.8go | build de 07:11 UTC | |
| CVE-2026-62176 critique | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generationpraisonai | GHSAGHSA 9.1pip | build de 07:11 UTC | |
| CVE-2026-92414 critique | : Session Fixation / Session Reuse across Users vulnerability in Apach ...jackrabbit | NVDNVD 9.1debian, rapidfort debian, echo | build de 07:11 UTC | |
| CVE-2026-105192 critique | LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportkserve-huggingfaceserver-cuda-13.3, lmcache, lmcache-cuda-13.0 | GHSAGHSA 9.8chainguard, pip | build de 07:11 UTC | |
| CVE-2026-81535 critique | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel…wolfssh | NVDNVD 9.1alpine | build de 07:11 UTC | |
| CVE-2026-106486 critique | plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server | NVDNVD 9.9npm | build de 07:11 UTC | |
| CVE-2026-95106 critique | Gitea review and execution mismatch through duplicate tree entriesgitea, gitea-fips | BitnamiBitnami 9.1rapidfort alpine, minimos, bitnami | build de 07:11 UTC | |
| CVE-2026-73278 critique | Gitea WebAuthn bypass during OAuth and OIDC sign-ingitea, gitea-fips | BitnamiBitnami 9.8rapidfort alpine, minimos, alpine, bitnami | build de 07:11 UTC | |
| CVE-2026-106237 critique | chromium-browser: Information leak in Permissionschromium, chromedriver, chromium-common et 3 autres | NVDNVD 9.6rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | build de 07:11 UTC | |
| CVE-2026-106195 critique | chromium-browser: Incorrect authorization in Chromotingchromium, chromedriver, chromium-common et 3 autres | NVDNVD 9.1rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | build de 07:11 UTC | |
| CVE-2026-106102 critique | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasar | GHSAGHSA 10.0npm | build de 07:11 UTC | |
| CVE-2026-105863 critique | Payload authentication token field handling issuepayload | NVD, GHSANVD 9.4npm | build de 07:11 UTC | |
| CVE-2026-105859 critique | Payload: Unauthorized update to collection documentspayload | GHSAGHSA 9.8npm | build de 07:11 UTC | |
| CVE-2026-105857 critique | Payload Form Builder has an RCE issue@payloadcms/plugin-form-builder | GHSAGHSA 10.0npm | build de 07:11 UTC | |
| CVE-2026-105848 critique | Payload: Insufficient Access Control in Stripe REST Proxy@payloadcms/plugin-stripe | NVDNVD 9.6npm | build de 07:11 UTC | |
| CVE-2026-105845 critique | Payload: SQL Injection in SQLite and Postgrespayload | GHSAGHSA 9.8npm | build de 07:11 UTC | |
| CVE-2026-105844 critique | Payload: Prototype pollution in Payload Import Export plugin@payloadcms/plugin-import-export | GHSAGHSA 9.3npm | build de 07:11 UTC | |
| CVE-2026-105794 critique | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLMicrosoft.Native.Quic.MsQuic.OpenSSL, microsoft.native.quic.msquic.openssl | GHSAGHSA 9.1nuget | build de 07:11 UTC | |
| CVE-2026-105697 critique | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationlangflow, langflow-base, lfx | GHSAGHSA 10.0pip | build de 07:11 UTC | |
| GHSA-v2f8-6655-7grj critique | Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainvibe-trading-ai | GHSAGHSA 10.0pip | build de 07:11 UTC | |
| GHSA-jqmf-mx4f-hfr6 critique | Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFvibe-trading-ai | GHSAGHSA 10.0pip | build de 07:11 UTC | |
| GHSA-gg6r-gp4c-89hp critique | Trigger.dev: V1 coordinator default-secret unauth Socket.IOtrigger.dev | GHSAGHSA 9.2npm | build de 07:11 UTC | |
| CVE-2026-103922 critique | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path@capacitor/android, @capacitor/ios, com.capacitorjs:core et 1 autres | GHSAGHSA 9.3npm, maven, swift | build de 07:11 UTC | |
| CVE-2026-101276 critique | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use- ...iperf3, iperf, iperf-doc | Photon OSPhoton OS, debian, rapidfort debian, alpine | build de 07:11 UTC | |
| CVE-2026-55107 critique | kobako Sandbox Escape - guest eval reaches host RCE via method_missing → public_send (any bound Service)kobako | GHSA, Ruby Advisory DBGHSA 10.0rubygems | build de 07:11 UTC | |
| GHSA-vcvr-r3jv-pc5j critique | Next.js: Remote Code Execution in next/og ImageResponsenext | GHSAGHSA 9.5echo npm, npm | build de 07:11 UTC | |
| CVE-2026-102828 critique | simple-git: simple-git unsafe-operation guard does not block trailer command configurationgrafana, grafana-selinux, renovate et 5 autres | NVD, GHSANVD 9.8rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, rapidfort rocky, Red Hat +6 | build de 07:11 UTC | |
| CVE-2026-102827 critique | simple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)renovate, simple-git, @seal-security/simple-git et 17 autres | NVDNVD 9.8Red Hat, chainguard, minimos, seal npm, npm +1 | build de 07:11 UTC | |
| CVE-2026-102560 critique | libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growthlibsoup3, libsoup, libsoup2.4 et 7 autres | NVDNVD 9.8rapidfort ubuntu, ubuntu, rapidfort debian, debian, alma +10 | build de 07:11 UTC | |
| CVE-2026-102676 critique | electron: electron: Privilege escalation via unauthorized Node.js integration in web workerselectron | NVDNVD 9.8npm | build de 07:11 UTC | |
| CVE-2026-102268 critique | pyjwt: PyJWT: Authentication bypass via improper public key validationpyjwt, fence-agents-aliyun, fence-agents-all et 147 autres | GHSA, Red Hat, Azure Linux, Photon OSGHSA 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +16 | build de 07:11 UTC | |
| CVE-2026-102267 critique | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirectspyjwt, fence-agents-aliyun, fence-agents-all et 157 autres | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, chainguard +16 | build de 07:11 UTC | |
| CVE-2026-102266 critique | pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptancefence-agents-aliyun, fence-agents-all, fence-agents-aws et 142 autres | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +15 | build de 07:11 UTC |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.