Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-107812
yüksek		Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM07:11 UTC derlemesi
CVE-2026-107811
yüksek		0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser07:11 UTC derlemesi
CVE-2026-107810
yüksek		Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied07:11 UTC derlemesi
CVE-2026-107809
yüksek		Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs07:11 UTC derlemesi
CVE-2026-107808
yüksek		Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)07:11 UTC derlemesi
CVE-2026-107807
yüksek		Nginx UI: Node Secret Credential Exposure via URL Query Parameter07:11 UTC derlemesi
CVE-2026-102554
yüksek		com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization07:11 UTC derlemesi
CVE-2026-95702
yüksek		gvisor.dev/gvisor: gVisor: Arbitrary code execution via use-after-free in VFS07:11 UTC derlemesi
CVE-2026-108106
yüksek		org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression07:11 UTC derlemesi
CVE-2026-107806
yüksek		Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite07:11 UTC derlemesi
CVE-2026-107805
yüksek		Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage07:11 UTC derlemesi
CVE-2026-97791
yüksek		org.apache.cxf/cxf-rt-ws-security: Apache CXF: Authentication bypass via shared token validation state07:11 UTC derlemesi
CVE-2026-97468
yüksek		org.apache.cxf/cxf-rt-ws-security: org.apache.cxf/cxf-services-sts-core: Apache CXF: Authentication bypass via hash collision in token cache07:11 UTC derlemesi
CVE-2026-78384
yüksek		org.apache.cxf/cxf-core: Apache CXF: Denial of Service via uncontrolled data decompression07:11 UTC derlemesi
CVE-2026-108039
yüksek		org.apache.cxf/cxf-core: Apache CXF: Denial of Service via unrestricted XML parsing07:11 UTC derlemesi
CVE-2026-107937
yüksek		org.apache.cxf/cxf-core: Apache CXF: Denial of Service via large multipart attachment headers07:11 UTC derlemesi
CVE-2026-107935
yüksek		gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose07:11 UTC derlemesi
CVE-2026-98378
yüksek		kernel: bpf: Skip unsettled links in link iterator07:11 UTC derlemesi
CVE-2026-97031
yüksek		crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references07:11 UTC derlemesi
CVE-2026-78669
yüksek		net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames07:11 UTC derlemesi
CVE-2026-78667
yüksek		net/http: golang: golang: Denial of Service via crafted HTTP Range headers07:11 UTC derlemesi
CVE-2026-107728
yüksek		strawberry-graphql: strawberry-graphql: Authorization bypass via improper permission evaluation07:11 UTC derlemesi
CVE-2026-89091
yüksek		ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution07:11 UTC derlemesi
CVE-2026-107726
yüksek		com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client07:11 UTC derlemesi
CVE-2026-107725
yüksek		com.hazelcast/hazelcast: Hazelcast: arbitrary code execution via missing authorization checks in IMap Predicates API07:11 UTC derlemesi
CVE-2026-107724
yüksek		fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery07:11 UTC derlemesi
CVE-2026-107723
yüksek		fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array07:11 UTC derlemesi
CVE-2026-107720
yüksek		fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set07:11 UTC derlemesi
CVE-2026-107716
yüksek		banks: Banks: Information disclosure via symbolic link traversal07:11 UTC derlemesi
CVE-2026-107392
yüksek		music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)07:11 UTC derlemesi
CVE-2026-107391
yüksek		music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master07:11 UTC derlemesi
CVE-2026-106432
yüksek		php-pecl-mongodb: php-pecl-mongodb: Denial of Service via heap buffer overflow in BSON encoder07:11 UTC derlemesi
CVE-2026-107385
yüksek		MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES07:11 UTC derlemesi
CVE-2026-107384
yüksek		MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)07:11 UTC derlemesi
CVE-2026-107383
yüksek		MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters07:11 UTC derlemesi
CVE-2026-97147
yüksek		openstack-mistral: mistral: Cross-project resource tampering via missing ownership check in action definition and environment update paths07:11 UTC derlemesi
CVE-2026-93858
yüksek		openstack-mistral: mistral: OS command injection via unvalidated proxy_command in std.ssh_proxied action07:11 UTC derlemesi
CVE-2026-107378
yüksek		CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Pr ...07:11 UTC derlemesi
CVE-2026-107377
yüksek		datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory07:11 UTC derlemesi
CVE-2026-107375
yüksek		JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort07:11 UTC derlemesi
CVE-2026-107303
yüksek		JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob07:11 UTC derlemesi
CVE-2026-107302
yüksek		msgpack5: Truncated map32 headers throw an unexpected error07:11 UTC derlemesi
CVE-2026-107300
yüksek		msgpack5: Many buffered values can exhaust the streaming decoder stack07:11 UTC derlemesi
CVE-2026-107295
yüksek		pydantic-ai-slim: pydantic-ai-slim: Unauthorized tool execution via missing Content-Type validation07:11 UTC derlemesi
CVE-2026-93017
yüksek		insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader07:11 UTC derlemesi
CVE-2026-107286
yüksek		pydantic-ai: pydantic-ai: Denial of Service via unreleased concurrency slots in streaming requests07:11 UTC derlemesi
CVE-2026-89322
yüksek		Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions07:11 UTC derlemesi
CVE-2026-107279
yüksek		org.asynchttpclient/async-http-client: AsyncHttpClient: Mutual authentication bypass via Digest auth-int negotiation07:11 UTC derlemesi
CVE-2026-107232
yüksek		org.asynchttpclient/async-http-client: async-http-client: Information disclosure via transmission of credentials after failed proxy CONNECT07:11 UTC derlemesi
CVE-2026-107231
yüksek		org.asynchttpclient/async-http-client: async-http-client: Credential exposure via authentication downgrade07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.