Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
GHSA-2rqm-h6hv-g79v
orta		odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values07:11 UTC derlemesi
GHSA-mhf7-xp6r-6qrc
orta		Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order07:11 UTC derlemesi
GHSA-h53f-rm2w-w7rg
orta		Echo: X-Real-IP extractor trusts the header value instead of the sending peer07:11 UTC derlemesi
GHSA-x9ff-22gv-65f4
orta		Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests07:11 UTC derlemesi
CVE-2026-115586
orta		virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script07:11 UTC derlemesi
CVE-2026-115585
orta		pypdf: pypdf: Denial of Service via malformed cross-reference streams07:11 UTC derlemesi
CVE-2026-115580
orta		pypdf: pypdf: Denial of Service via excessive cross-reference table entries07:11 UTC derlemesi
CVE-2026-115572
orta		pypdf: pypdf: Denial of Service via repeated nonexistent object references07:11 UTC derlemesi
GHSA-xp3q-r38w-vgqm
orta		SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized07:11 UTC derlemesi
CVE-2026-115567
orta		Tokio: Race condition in `tokio::time::Interval`07:11 UTC derlemesi
CVE-2026-115754
orta		serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization07:11 UTC derlemesi
CVE-2026-90458
orta		openstack-ironic: openstack-ironic: Redfish vendor_passthru subscription id path traversal07:11 UTC derlemesi
CVE-2026-89419
orta		openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH07:11 UTC derlemesi
CVE-2026-115486
orta		open-iscsi: open-iscsi: IPv6 Neighbor Discovery missing option length validation in iscsiuio allows ARP table poisoning07:11 UTC derlemesi
CVE-2026-115485
orta		open-iscsi: open-iscsi: DHCPv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio07:11 UTC derlemesi
CVE-2026-115484
orta		open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg07:11 UTC derlemesi
CVE-2026-115424
orta		oc: oc: Symlink/hardlink target validation bypass in oc image extract allows file write outside destination07:11 UTC derlemesi
CVE-2026-115221
orta		ipa: freeIPA: FreeIPA uses subject CN as proof of certificate ownership07:11 UTC derlemesi
CVE-2026-114620
orta		authlib: Authlib: Server-Side Request Forgery via unvalidated request URI07:11 UTC derlemesi
CVE-2026-114619
orta		authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant07:11 UTC derlemesi
CVE-2026-114618
orta		authlib: Authlib: Unauthorized access via improper JWT audience validation07:11 UTC derlemesi
CVE-2026-114617
orta		authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens07:11 UTC derlemesi
CVE-2026-115391
orta		wasmtime: wasmtime: Denial of Service via unbounded buffering in WASIp3 write streams07:11 UTC derlemesi
CVE-2026-115390
orta		wasmtime: wasmtime: Denial of Service via fuel accounting flaw07:11 UTC derlemesi
CVE-2026-115383
orta		wasmtime: wasmtime: Denial of Service via improper validation of WebAssembly tag imports07:11 UTC derlemesi
CVE-2026-115382
orta		wasmtime: wasmtime: Denial of Service via zero timeout in HTTP request option07:11 UTC derlemesi
CVE-2026-115379
orta		wasmtime: Wasmtime: Denial of Service via missing garbage collection rooting07:11 UTC derlemesi
CVE-2026-115378
orta		github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull07:11 UTC derlemesi
CVE-2026-115373
orta		github.com/lxc/incus: Incus: Information disclosure via missing authorization check in operations endpoint07:11 UTC derlemesi
CVE-2026-115365
orta		github.com/openbao/openbao: OpenBao: Privilege escalation via ACL policy cache namespace traversal07:11 UTC derlemesi
CVE-2026-115354
orta		mistune: mistune: Information disclosure via path traversal in Include directive07:11 UTC derlemesi
CVE-2026-115351
orta		mistune: mistune: Information disclosure via CSS injection in figure directive07:11 UTC derlemesi
CVE-2026-115350
orta		mistune: mistune: Cross-site scripting via Include directive07:11 UTC derlemesi
CVE-2026-114608
orta		pylint: pylint: Arbitrary code execution via untrusted cache deserialization07:11 UTC derlemesi
CVE-2026-114603
orta		opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing07:11 UTC derlemesi
CVE-2026-114348
orta		webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header07:11 UTC derlemesi
CVE-2026-114570
orta		wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit07:11 UTC derlemesi
CVE-2026-114732
orta		roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments07:11 UTC derlemesi
CVE-2026-114722
orta		roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages07:11 UTC derlemesi
CVE-2026-114718
orta		roundcubemail: roundcubemail: Cross-site scripting via unescaped password driver error messages07:11 UTC derlemesi
CVE-2026-114508
orta		Laravel relationship inclusion can trigger unauthorized data destruction07:11 UTC derlemesi
CVE-2026-96642
orta		pillow: Pillow: Denial of Service via negative archive member size in TarIO07:11 UTC derlemesi
CVE-2026-96641
orta		pillow: pillow: Denial of Service via integer overflow in text-width calculation07:11 UTC derlemesi
CVE-2026-96638
orta		pillow: pillow: Denial of Service via crafted RLE BMP image07:11 UTC derlemesi
CVE-2026-96637
orta		pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images07:11 UTC derlemesi
CVE-2026-96636
orta		pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images07:11 UTC derlemesi
CVE-2026-85518
orta		openscap: openscap: Arbitrary file write via path traversal in Source DataStream decomposition07:11 UTC derlemesi
CVE-2026-114438
orta		keycloak-services: keycloak-services: Required OTP enrollment bypassed via Update User Locale required action ordering07:11 UTC derlemesi
CVE-2026-92205
orta		busybox: busybox: Arbitrary file creation via directory traversal07:11 UTC derlemesi
CVE-2026-114133
orta		Nuxt server islands render `useHeadSafe` input without sanitisation07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.