Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-107230
yüksek		org.asynchttpclient/async-http-client: async-http-client: Information disclosure via improper connection pool partitioning07:11 UTC derlemesi
CVE-2026-105816
yüksek		github.com/hashicorp/vault: Vault: Arbitrary code execution via plugin catalog entries in restored snapshots07:11 UTC derlemesi
CVE-2026-107227
yüksek		org.asynchttpclient/async-http-client: AsyncHttpClient: Denial of Service via unbounded WebSocket decompression07:11 UTC derlemesi
CVE-2026-107223
yüksek		Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process07:11 UTC derlemesi
CVE-2026-107219
yüksek		Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile07:11 UTC derlemesi
CVE-2026-107217
yüksek		Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows07:11 UTC derlemesi
CVE-2026-56851
yüksek		golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile07:11 UTC derlemesi
CVE-2026-107216
yüksek		Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow07:11 UTC derlemesi
CVE-2026-107215
yüksek		Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS07:11 UTC derlemesi
CVE-2026-107214
yüksek		Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks07:11 UTC derlemesi
CVE-2026-107212
yüksek		Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days07:11 UTC derlemesi
CVE-2026-92543
yüksek		github.com/moby/moby: Docker Engine: Certificate verification bypass via flawed registry DNS check07:11 UTC derlemesi
CVE-2026-92542
yüksek		github.com/moby/moby: Moby: Unauthorized traffic injection via forged VXLAN datagrams07:11 UTC derlemesi
CVE-2026-62251
yüksek		Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query07:11 UTC derlemesi
CVE-2026-106557
yüksek		Backstage has improper input validation in TechDocs Markdown extension configuration07:11 UTC derlemesi
CVE-2026-107209
yüksek		ImageMagick: ImageMagick: Denial of Service via crafted RSVG image07:11 UTC derlemesi
CVE-2026-106580
yüksek		ImageMagick: ImageMagick: Information disclosure via missing security policy check in CUT encoder07:11 UTC derlemesi
CVE-2026-106579
yüksek		ImageMagick: ImageMagick: Information disclosure via security policy bypass07:11 UTC derlemesi
CVE-2026-106578
yüksek		ImageMagick: ImageMagick: Denial of Service via invalid memory free in MVG decoder07:11 UTC derlemesi
CVE-2026-106576
yüksek		ImageMagick: ImageMagick: Denial of Service via crafted XMP profile07:11 UTC derlemesi
CVE-2026-106573
yüksek		ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder07:11 UTC derlemesi
CVE-2026-106567
yüksek		ImageMagick: ImageMagick: Denial of Service via crafted PSD file07:11 UTC derlemesi
CVE-2026-106565
yüksek		ImageMagick: ImageMagick: Denial of Service via missing end-of-file check in bzip2 images07:11 UTC derlemesi
CVE-2026-77214
yüksek		expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer07:11 UTC derlemesi
CVE-2026-106558
yüksek		@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Arbitrary code execution via improper markdown extension configuration07:11 UTC derlemesi
CVE-2026-106556
yüksek		plugin-techdocs-node: plugin-techdocs-node: arbitrary command execution via configuration sanitization bypass07:11 UTC derlemesi
CVE-2026-106510
yüksek		plugin-techdocs-node: plugin-techdocs-node: Arbitrary code execution via crafted mkdocs configuration07:11 UTC derlemesi
CVE-2026-46569
yüksek		In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ...07:11 UTC derlemesi
CVE-2026-46434
yüksek		wger: Trainer Privilege Escalation - Improper Privilege Management07:11 UTC derlemesi
CVE-2026-43976
yüksek		wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)07:11 UTC derlemesi
CVE-2026-42616
yüksek		In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ...07:11 UTC derlemesi
CVE-2026-107183
yüksek		llama.cpp: llama.cpp: Arbitrary code execution via crafted completion request07:11 UTC derlemesi
CVE-2026-83742
yüksek		Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows pla07:11 UTC derlemesi
CVE-2026-83540
yüksek		When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired f07:11 UTC derlemesi
CVE-2026-16516
yüksek		wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiate07:11 UTC derlemesi
CVE-2026-106471
yüksek		candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching07:11 UTC derlemesi
CVE-2026-106583
yüksek		openssh: openssh: Command injection via unvalidated command-line username07:11 UTC derlemesi
CVE-2026-86684
yüksek		Gitea push mirror local path check uses the repository owner07:11 UTC derlemesi
CVE-2026-106509
yüksek		plugin-techdocs-node: Backstage plugin-techdocs-node: Arbitrary code execution via improper MkDocs configuration validation07:11 UTC derlemesi
CVE-2026-106505
yüksek		plugin-techdocs-node: @backstage/plugin-techdocs-node: Backstage plugin-techdocs-node: Arbitrary code execution via MkDocs configuration sanitizer bypass07:11 UTC derlemesi
CVE-2026-106503
yüksek		plugin-scaffolder-backend: plugin-scaffolder-backend: Authorization bypass via scaffolder action inputs07:11 UTC derlemesi
CVE-2026-106501
yüksek		@backstage/plugin-scaffolder-backend: Backstage: Sensitive information exposure in Scaffolder07:11 UTC derlemesi
CVE-2026-106500
yüksek		@backstage/plugin-scaffolder-backend: @backstage/plugin-scaffolder-backend: Unauthorized file manipulation via improper task state validation07:11 UTC derlemesi
CVE-2026-106555
yüksek		openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence07:11 UTC derlemesi
CVE-2026-106553
yüksek		openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication07:11 UTC derlemesi
CVE-2026-106550
yüksek		convict: convict: Denial of Service via prototype pollution in config.set()07:11 UTC derlemesi
CVE-2026-106547
yüksek		hdf5: hdf5: Arbitrary code execution via heap-based buffer overflow07:11 UTC derlemesi
CVE-2026-106488
yüksek		plugin-auth-backend-module-oidc-provider: plugin-auth-backend-module-oidc-provider: Privilege escalation via unverified email addresses07:11 UTC derlemesi
CVE-2026-106459
yüksek		Backstage: Improper input validation in Sentry scaffolder actions07:11 UTC derlemesi
CVE-2026-101258
yüksek		ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.