Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-96893
yüksek		Improper Neutralization of Input Used for LLM Prompting in GitLab07:11 UTC derlemesi
CVE-2026-92883
yüksek		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab07:11 UTC derlemesi
CVE-2026-81839
yüksek		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-16301
yüksek		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-14814
yüksek		Permissive Regular Expression in GitLab07:11 UTC derlemesi
CVE-2026-84312
yüksek		Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)07:11 UTC derlemesi
CVE-2026-103658
yüksek		aspell: aspell: Arbitrary code execution via crafted dictionary file07:11 UTC derlemesi
CVE-2026-84360
yüksek		Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools07:11 UTC derlemesi
CVE-2026-84319
yüksek		Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context07:11 UTC derlemesi
CVE-2026-84318
yüksek		Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE07:11 UTC derlemesi
CVE-2026-84317
yüksek		Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)07:11 UTC derlemesi
CVE-2026-84316
yüksek		Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)07:11 UTC derlemesi
CVE-2026-84315
yüksek		Nginx UI OTP secure-session step-up is missing on sensitive mutation routes07:11 UTC derlemesi
CVE-2026-84314
yüksek		Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint07:11 UTC derlemesi
CVE-2026-84313
yüksek		Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover07:11 UTC derlemesi
CVE-2026-109380
yüksek		modern-tar: modern-tar: Denial of Service via memory exhaustion from crafted archives07:11 UTC derlemesi
CVE-2026-95837
yüksek		github.com/containerd/containerd: containerd: Privilege escalation via crafted container checkpoint restore07:11 UTC derlemesi
CVE-2026-41510
yüksek		Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding07:11 UTC derlemesi
CVE-2026-87744
yüksek		io.quarkus:quarkus-hibernate-orm-rest-data-panache: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations07:11 UTC derlemesi
CVE-2026-65954
yüksek		Arbitrary code execution07:11 UTC derlemesi
CVE-2026-57143
yüksek		PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter07:11 UTC derlemesi
CVE-2026-103061
yüksek		gleam: gleam: Arbitrary directory deletion via path traversal in package metadata07:11 UTC derlemesi
CVE-2026-75888
yüksek		openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch07:11 UTC derlemesi
CVE-2026-109301
yüksek		Parse Server before 8.6.95 and 9.0.0 before 9.10.2 Denial of Service via File Pointer Without URL07:11 UTC derlemesi
CVE-2026-109242
yüksek		freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling07:11 UTC derlemesi
CVE-2026-96612
yüksek		hex: hex: Arbitrary code execution via path traversal in dependency application names07:11 UTC derlemesi
CVE-2026-108094
yüksek		mutter: mutter: client-triggered use-after-free in Wayland color-management ICC image description path07:11 UTC derlemesi
CVE-2026-52903
yüksek		manageiq: YAML safe_load production fallback to unsafe_load enables RCE via deserialization07:11 UTC derlemesi
CVE-2026-108976
yüksek		emacs: zero-click local command execution via TRAMP07:11 UTC derlemesi
CVE-2026-108859
yüksek		github.com/mark3labs/mcp-go: mcp-go: Denial of Service via unbounded HTTP request body buffering07:11 UTC derlemesi
CVE-2026-62376
yüksek		Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access07:11 UTC derlemesi
CVE-2026-62367
yüksek		Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover07:11 UTC derlemesi
CVE-2026-57458
yüksek		Vikunja: Scoped API token can mint unrestricted OAuth session credentials07:11 UTC derlemesi
CVE-2026-108260
yüksek		@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS07:11 UTC derlemesi
CVE-2026-108259
yüksek		Tina: Code injection via unescaped Git branch name in generated client source07:11 UTC derlemesi
GHSA-m687-p538-r5hp
yüksek		Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted07:11 UTC derlemesi
CVE-2026-107840
yüksek		yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels07:11 UTC derlemesi
CVE-2026-107839
yüksek		ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service07:11 UTC derlemesi
CVE-2026-107826
yüksek		Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)07:11 UTC derlemesi
CVE-2026-107823
yüksek		mariadb: mariadb: Privilege escalation via unescaped newlines in view parser07:11 UTC derlemesi
CVE-2026-107818
yüksek		mariadb: mariadb: Privilege escalation via environment variable injection during service restart07:11 UTC derlemesi
CVE-2026-55797
yüksek		github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: Arbitrary command execution via crafted SSH repository proxy configuration07:11 UTC derlemesi
CVE-2026-107815
yüksek		mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write07:11 UTC derlemesi
CVE-2025-61560
yüksek		github.com/argoproj/argo-cd: argo-cd: Rate limit bypass via race condition in SessionManager07:11 UTC derlemesi
GHSA-68w4-83fh-f2w8
yüksek		pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password07:11 UTC derlemesi
GHSA-jq7h-wrvp-3rgx
yüksek		pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session07:11 UTC derlemesi
GHSA-889w-m37p-88m5
yüksek		pyLoad: Api.set_user_permission never invalidates the target's session07:11 UTC derlemesi
GHSA-fr26-jjhm-638c
yüksek		pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)07:11 UTC derlemesi
GHSA-r44w-v6gf-x3p6
yüksek		pyLoad has an authentication bypass in API key validation (check_apikey cache)07:11 UTC derlemesi
CVE-2026-107814
yüksek		mariadb: mariadb: Arbitrary code execution via insecure service account home directory07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.