Zafiyetler
Gate'in zaten bildiği kritik zafiyetler.
Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.
Database son güncelleme27 Eki 2026, 13:12 UTC
23kritik, son 7 gün298yüksek, son 7 gün633orta, son 7 gün139düşük, son 7 gün| ID | Zafiyet | Önem derecesi kaynağı / ekosistemler | Kritik olduğu tarih | Yayın |
|---|---|---|---|---|
| CVE-2026-99083 kritik | kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()linux | Red HatRed Hat 9.8debian, echo | 07:13 UTC derlemesi | |
| GHSA-xgh2-jgvm-8g78 kritik | Unsigned ID tokens (alg none) accepted, allowing authentication bypass in the id_token flowomniauth_oidc | Ruby Advisory DBrubygems | 19:14 UTC derlemesi | |
| CVE-2026-99078 kritik | In the Linux kernel, the following vulnerability has been resolved: n ...linux, bpftool, kernel6.12 ve 7 tane daha | Photon OSPhoton OS, debian, rapidfort amazon linux | 19:10 UTC derlemesi | |
| CVE-2026-98959 kritik | In the Linux kernel, the following vulnerability has been resolved: b ...linux, bpftool, kernel6.12 ve 7 tane daha | Photon OSPhoton OS, debian, rapidfort amazon linux, echo | 19:10 UTC derlemesi | |
| CVE-2026-115889 kritik | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, th ...rust-wasmtime, wasmtime | GHSAGHSA 10.0debian, rapidfort debian, cargo, echo | 07:11 UTC derlemesi | |
| GHSA-cxf3-9h37-7rr8 kritik | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsgithub.com/labstack/echo/v4, github.com/labstack/echo/v5 | GHSAGHSA 9.1go | 07:11 UTC derlemesi | |
| CVE-2026-57116 kritik | PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocationpraisonai | GHSAGHSA 9.8pip | 07:11 UTC derlemesi | |
| CVE-2026-114612 kritik | litellm: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | Red HatRed Hat 8.8 | 07:11 UTC derlemesi | |
| CVE-2026-97631 kritik | edk2: Pre-boot RCE in EDK II PXE driveredk2, edk2-tools, edk2-aarch64 ve 4 tane daha | Red HatRed Hat 8.8rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, rapidfort fedora +4 | 07:11 UTC derlemesi | |
| GHSA-673q-mjm6-r5xr kritik | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysnext, @seal-security/next | GHSAGHSA 9.5seal npm, echo npm, npm | 07:11 UTC derlemesi | |
| GHSA-cg2g-xh64-v4q7 kritik | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesdompurify, @seal-security/dompurify | GHSAGHSA 9.2seal npm, echo npm, npm | 07:11 UTC derlemesi | |
| GHSA-2464-fhr4-w9xw kritik | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usednext, @seal-security/next | GHSAGHSA 9.5seal npm, echo npm, npm | 07:11 UTC derlemesi | |
| GHSA-9v8h-qqgm-4m35 kritik | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packagebrotli, brotlicffi | GHSAGHSA 9.2pip | 07:11 UTC derlemesi | |
| CVE-2026-115324 kritik | mem0ai Databricks vector store vulnerable to SQL injectionmem0ai | GHSAGHSA 9.2pip | 07:11 UTC derlemesi | |
| CVE-2026-91403 kritik | OpenJDK: Distrust eMudhra intermediate CA certificates due to security concernsjava-21-openjdk, java-21-openjdk-devel, java-21-openjdk-headless ve 140 tane daha | Red HatRed Hat 6.8rapidfort alma, Red Hat, amazon linux, rapidfort amazon linux, rapidfort Red Hat +4 | 07:11 UTC derlemesi | |
| CVE-2026-114509 kritik | Laravel TokenGuard authentication bypass through non-string API credentialslaravel/framework | GHSAGHSA 9.2composer | 07:11 UTC derlemesi | |
| CVE-2026-96639 kritik | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-fr ...pillow, nemo-gym, nemo-rl-cuda-13.0 ve 3 tane daha | GHSAGHSA 9.8chainguard, debian, rapidfort debian, echo, echo pip +1 | 07:11 UTC derlemesi | |
| CVE-2026-114406 kritik | ca-certificates: Distrust eMudhra intermediate CA certificates due to security concernsca-certificates, rf-ca-certificates, openshift/ose-rhel-coreos-8 ve 1 tane daha | Red Hat, AlmaLinux, Oracle, Rocky LinuxRed Hat 6.8rapidfort rocky, Red Hat, alma, rocky, Oracle Linux +4 | 07:11 UTC derlemesi | |
| CVE-2026-114139 kritik | Sentry-Javascript: Middleware Bypass when using Tunnel route@sentry/nextjs, langfuse-3, langfuse-4 ve 3 tane daha | GHSAGHSA 9.1chainguard, echo npm, npm, wolfi | 07:11 UTC derlemesi | |
| CVE-2026-109618 kritik | php: OOM bailout during request parsing leads to memory corruption and RCEphp, php-bcmath, php-cli ve 529 tane daha | NVD, Azure Linux, Bitnami, UbuntuNVD 9.8alma, amazon linux, rocky, rapidfort amazon linux, rapidfort alma +16 | 07:11 UTC derlemesi | |
| CVE-2026-71195 kritik | manila: manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writesmanila, openstack-manila, openstack-manila-share ve 3 tane daha | Red HatRed Hat 8.8Red Hat, debian, rapidfort debian, echo | 07:11 UTC derlemesi | |
| GHSA-hq85-5cpj-mr62 kritik | uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromiseduv, python3-uv | GHSAGHSA 9.1rapidfort alpine, rapidfort Oracle Linux, rapidfort fedora, pip | 07:11 UTC derlemesi | |
| GHSA-6q48-6c7w-9gw2 kritik | certifi bundles emSign root CAs with compromised intermediate CA keyspython3-certifi, certifi, python-certifi | GHSAGHSA 9.1rapidfort fedora, rapidfort Oracle Linux, echo pip, pip | 07:11 UTC derlemesi | |
| CVE-2026-112900 kritik | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is ...pillow, open-webui, py3-pillow ve 9 tane daha | GHSA, BitnamiGHSA 9.2chainguard, debian, rapidfort debian, seal pip, wolfi +5 | 07:11 UTC derlemesi | |
| CVE-2026-112403 kritik | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ...pillow, gftools, kserve ve 29 tane daha | GHSA, BitnamiGHSA 9.2chainguard, wolfi, debian, rapidfort debian, seal pip +4 | 07:11 UTC derlemesi | |
| CVE-2026-112398 kritik | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ...pillow, nemo-skills, python-pillow ve 1 tane daha | GHSA, BitnamiGHSA 9.2debian, rapidfort debian, seal pip, bitnami, chainguard +4 | 07:11 UTC derlemesi | |
| CVE-2026-112393 kritik | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow ha ...pillow, open-webui, py3-pillow ve 9 tane daha | NVD, GHSA, BitnamiNVD 9.8chainguard, debian, rapidfort debian, seal pip, wolfi +5 | 07:11 UTC derlemesi | |
| CVE-2026-111058 kritik | Mercury: Unauthenticated Remote Code Execution via /api/kernelsmercury | GHSAGHSA 9.8pip | 07:11 UTC derlemesi | |
| CVE-2026-111057 kritik | Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmercury | GHSAGHSA 10.0pip | 07:11 UTC derlemesi | |
| CVE-2026-96620 kritik | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Executionclaude-agent-sdk | GHSAGHSA 9.2pip | 07:11 UTC derlemesi | |
| CVE-2026-111375 kritik | freerdp: FreeRDP: Denial of Service via out-of-bounds read in RAIL window titlefreerdp, freerdp-devel, freerdp-libs ve 6 tane daha | NVDNVD 9.1rapidfort alma, rapidfort rocky, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat +6 | 07:11 UTC derlemesi | |
| CVE-2026-57496 kritik | netlicensing-mcp: REST Path Traversal Bypasses Token Redactionnetlicensing-mcp | GHSAGHSA 9.6pip | 07:11 UTC derlemesi | |
| CVE-2026-109829 kritik | undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect cachingnode-undici, nodejs24, nodejs24-devel ve 47 tane daha | NVDNVD 9.1Red Hat, rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, amazon linux +7 | 07:11 UTC derlemesi | |
| CVE-2026-109383 kritik | undici: undici: Certificate validation bypass via dropped TLS options in Agentnode-undici, nodejs24, nodejs24-devel ve 57 tane daha | NVDNVD 9.1Red Hat, amazon linux, rapidfort amazon linux, rapidfort Oracle Linux, rapidfort Red Hat +7 | 07:11 UTC derlemesi | |
| CVE-2026-110858 kritik | GitPython: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspecpython-git, gitpython, python-gitpython ve 4 tane daha | Red HatRed Hat 8.1Red Hat, debian, rapidfort debian, seal pip, echo | 07:11 UTC derlemesi | |
| CVE-2026-102748 kritik | Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Servicegithub.com/dgraph-io/dgraph/v25 | GHSAGHSA 9.2go | 07:11 UTC derlemesi | |
| CVE-2026-73802 kritik | gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledgitea, gitea-fips, gitea.com/gitea/runner | GHSAGHSA 10.0minimos, go | 07:11 UTC derlemesi | |
| CVE-2026-104252 kritik | Vitess vttablet /twopcz reflected XSSvitess.io/vitess | GHSAGHSA 9.8go | 07:11 UTC derlemesi | |
| CVE-2026-88092 kritik | dotnet: ASP.NET Core Tampering Vulnerabilitydotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0 ve 93 tane daha | GHSA, Red Hat, AlmaLinux, Amazon, Bitnami, Oracle, Rocky LinuxGHSA 9.4alma, rocky, rapidfort alma, Oracle Linux, amazon linux +9 | 07:11 UTC derlemesi | |
| CVE-2026-70188 kritik | dotnet: ASP.NET Core Security Feature Bypass Vulnerabilitydotnet-host, dotnet-sdk-8.0, dotnet-sdk-9.0 ve 92 tane daha | GHSA, Red Hat, AlmaLinux, Amazon, Oracle, Rocky LinuxGHSA 9.1alma, rocky, rapidfort alma, Oracle Linux, amazon linux +8 | 07:11 UTC derlemesi | |
| CVE-2026-105016 kritik | Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerabilitydotnet8-runtime, dotnet9-runtime, dotnet10-runtime ve 20 tane daha | GHSAGHSA 9.8rapidfort fedora, alpine, nuget | 07:11 UTC derlemesi | |
| CVE-2026-92892 kritik | github.com/jfrog/jfrog-cli: Potential command execution on the host running JFrog CLI. | Red HatRed Hat 9.0 | 07:11 UTC derlemesi | |
| CVE-2026-102989 kritik | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses@tanstack/react-start, @tanstack/solid-start, @tanstack/start-server-core ve 1 tane daha | GHSAGHSA 9.3npm | 07:11 UTC derlemesi | |
| CVE-2026-97229 kritik | ruby: integer overflow issue in CI/CD regular expression compilerruby, ruby-devel, ruby-libs ve 46 tane daha | Red Hat, BitnamiBitnami 10.0rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, rapidfort rocky, minimos +9 | 07:11 UTC derlemesi | |
| CVE-2026-57118 kritik | PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointspraisonaiagents | GHSAGHSA 9.8pip | 07:11 UTC derlemesi | |
| CVE-2026-77366 kritik | obsidian-tc tokens can access arbitrary configured vaultsobsidian-tc | GHSAGHSA 10.0npm | 07:11 UTC derlemesi | |
| CVE-2026-77363 kritik | obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopbackobsidian-tc | GHSAGHSA 9.7npm | 07:11 UTC derlemesi | |
| CVE-2026-108261 kritik | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment@tinacms/app, tinacms | GHSAGHSA 9.3npm | 07:11 UTC derlemesi | |
| CVE-2026-107845 kritik | Contao: Cross-site scripting in the comments bundlecontao/comments-bundle | GHSAGHSA 9.3composer | 07:11 UTC derlemesi | |
| CVE-2026-107722 kritik | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionfast-jwt | GHSAGHSA 9.8npm | 07:11 UTC derlemesi |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.