Vulnérabilités

Les vulnérabilités critiques que le gate connaît déjà.

Toutes les six heures, Attestkeep récupère la Trivy vulnerability database, celle que le scanner lit dans votre cluster. Voici les entrées que la database a classées critiques cette semaine, et quand. Pas quand la nouvelle est tombée : quand le gate l'a su.

IDVulnérabilitéClassée depuisPubliée
CVE-2026-88815
élevée
perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type castingbuild de 07:11 UTC
CVE-2026-87114
élevée
kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudobuild de 07:11 UTC
CVE-2026-85644
élevée
perl-XS-Parse-Keyword: perl-XS-Parse-Keyword: Denial of Service via improper array reference validationbuild de 07:11 UTC
CVE-2026-101894
élevée
@xhmikosr/decompress: @xhmikosr/decompress: Path traversal via symlink chainbuild de 07:11 UTC
CVE-2026-93348
élevée
unsloth-zoo: unsloth: Unsloth Zoo: Arbitrary code execution via crafted model configurationbuild de 07:11 UTC
GHSA-456v-xq2p-r4cj
élevée
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)build de 07:11 UTC
CVE-2026-86330
élevée
noobaa-core: noobaa-core: OS command injection in cluster_internal_api.set_hostname_internalbuild de 07:11 UTC
CVE-2026-101292
élevée
artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserializationbuild de 07:11 UTC
CVE-2026-91006
élevée
org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance optionsbuild de 07:11 UTC
CVE-2026-94286
élevée
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parserbuild de 07:11 UTC
CVE-2026-101015
élevée
opendmarc: OpenDMARC: DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handlerbuild de 07:11 UTC
CVE-2026-101014
élevée
opendmarc: OpenDMARC: Denial of Service via off-by-one error in opendmarc_util_cleanupbuild de 07:11 UTC
CVE-2026-100888
élevée
A weakness has been identified in Trusted Domain Project OpenDKIM up t ...build de 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.