Vulnérabilités

Les vulnérabilités critiques que le gate connaît déjà.

Toutes les six heures, Attestkeep récupère la Trivy vulnerability database, celle que le scanner lit dans votre cluster. Voici les entrées que la database a classées critiques cette semaine, et quand. Pas quand la nouvelle est tombée : quand le gate l'a su.

IDVulnérabilitéClassée depuisPubliée
CVE-2026-95301
élevée
chromium-browser: Missing authorization in Extensionsbuild de 07:11 UTC
CVE-2026-95299
élevée
chromium-browser: Use after free in GPUbuild de 07:11 UTC
CVE-2026-95298
élevée
chromium-browser: Use after free in Browserbuild de 07:11 UTC
CVE-2026-95293
élevée
chromium-browser: Uninitialized resource in GPUbuild de 07:11 UTC
CVE-2026-95291
élevée
chromium-browser: UI misrepresentation in SecurityIndicatorsbuild de 07:11 UTC
CVE-2026-95286
élevée
chromium-browser: Type confusion in Bindingsbuild de 07:11 UTC
CVE-2026-95284
élevée
chromium-browser: angle: Buffer overflow in ANGLEbuild de 07:11 UTC
CVE-2026-95283
élevée
chromium-browser: Buffer overflow in Tintbuild de 07:11 UTC
CVE-2026-95282
élevée
chromium-browser: Use after free in Platformbuild de 07:11 UTC
CVE-2026-95281
élevée
chromium-browser: angle: Buffer overflow in ANGLEbuild de 07:11 UTC
CVE-2026-95280
élevée
chromium-browser: Race condition in V8build de 07:11 UTC
CVE-2026-95277
élevée
chromium-browser: Use after free in Viewsbuild de 07:11 UTC
CVE-2026-95274
élevée
chromium-browser: Improper output encoding in DevToolsbuild de 07:11 UTC
CVE-2026-102677
élevée
electron: Electron: Privilege escalation via sandboxed preload code cache poisoningbuild de 07:11 UTC
CVE-2026-102559
élevée
libsoup: libsoup: Heap buffer overflow during WebSocket client-frame maskingbuild de 07:11 UTC
CVE-2026-102558
élevée
libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growthbuild de 07:11 UTC
CVE-2026-102555
élevée
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decodingbuild de 07:11 UTC
CVE-2026-92227
élevée
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3build de 07:11 UTC
CVE-2026-92222
élevée
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3build de 07:11 UTC
CVE-2026-90906
élevée
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3build de 07:11 UTC
CVE-2026-102675
élevée
electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlersbuild de 07:11 UTC
CVE-2026-102557
élevée
libsoup: libsoup: Heap buffer overflow during WebSocket message reassemblybuild de 07:11 UTC
CVE-2026-102556
élevée
libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusionbuild de 07:11 UTC
CVE-2026-97689
élevée
urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parserbuild de 07:11 UTC
CVE-2026-97687
élevée
urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration overridebuild de 07:11 UTC
CVE-2026-84782
élevée
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionbuild de 07:11 UTC
CVE-2026-102600
élevée
Socket.IO: Prototype Pollution via Unsafe Client Session Lookupbuild de 07:11 UTC
CVE-2026-100308
élevée
gluonts: gluonts: Arbitrary command execution via untrusted model deserializationbuild de 07:11 UTC
CVE-2026-68911
élevée
nicotine-plus: nicotine-plus: Denial of Service via decompression bomb in peer messagesbuild de 07:11 UTC
CVE-2026-63209
élevée
github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processingbuild de 07:11 UTC
CVE-2026-100832
élevée
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de 07:11 UTC
CVE-2026-100811
élevée
firefox: firefox: Sandbox escape via use-after-free in DOM componentbuild de 07:11 UTC
CVE-2026-100793
élevée
firefox: JIT miscompilation in the JavaScript Engine componentbuild de 07:11 UTC
CVE-2026-100792
élevée
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly componentbuild de 07:11 UTC
CVE-2026-100791
élevée
firefox: Use-after-free in the DOM: Core & HTML componentbuild de 07:11 UTC
CVE-2026-100790
élevée
firefox: thunderbird: Use-after-free in the XSLT componentbuild de 07:11 UTC
CVE-2026-100789
élevée
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de 07:11 UTC
CVE-2026-100788
élevée
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly componentbuild de 07:11 UTC
CVE-2026-100787
élevée
firefox: Sandbox escape in the XUL componentbuild de 07:11 UTC
CVE-2026-100786
élevée
firefox: Sandbox escape due to use-after-free in the Graphics componentbuild de 07:11 UTC
CVE-2026-100785
élevée
firefox: thunderbird: Use-after-free in the DOM: Core & HTML componentbuild de 07:11 UTC
CVE-2026-100784
élevée
firefox: Use-after-free in the Layout: Text and Fonts componentbuild de 07:11 UTC
CVE-2026-100783
élevée
firefox: thunderbird: Uninitialized memory in the Audio/Video componentbuild de 07:11 UTC
CVE-2026-100782
élevée
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics componentbuild de 07:11 UTC
CVE-2026-100781
élevée
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender componentbuild de 07:11 UTC
CVE-2026-100780
élevée
firefox: thunderbird: Use-after-free in the DOM: Core & HTML componentbuild de 07:11 UTC
CVE-2026-100779
élevée
firefox: thunderbird: Use-after-free in the XSLT componentbuild de 07:11 UTC
CVE-2026-100778
élevée
firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML componentbuild de 07:11 UTC
CVE-2026-100777
élevée
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de 07:11 UTC
CVE-2026-100776
élevée
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly componentbuild de 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.