Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-101609
orta		mysql: mysql: Denial of service in InnoDB07:11 UTC derlemesi
CVE-2026-101608
orta		mysql: mysql: Denial of Service via Server Optimizer component07:11 UTC derlemesi
CVE-2026-101607
orta		mysql: mysql: Denial of Service in Server Optimizer07:11 UTC derlemesi
CVE-2026-101516
orta		openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)07:11 UTC derlemesi
CVE-2026-92388
orta		curl: curl: FTP wildcard write callback mixup07:11 UTC derlemesi
CVE-2026-113868
orta		thunderbird: Thunderbird: information disclosure via malformed authentication challenge07:11 UTC derlemesi
CVE-2026-113867
orta		thunderbird: thunderbird: Unauthorized actions via XMPP stanza injection07:11 UTC derlemesi
CVE-2026-113866
orta		thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup07:11 UTC derlemesi
CVE-2026-113724
orta		virtualenv: virtualenv: Insecure file permission modification via symlink following07:11 UTC derlemesi
CVE-2026-113721
orta		virtualenv: virtualenv: Arbitrary file overwrite via insecure symlink handling07:11 UTC derlemesi
CVE-2026-113720
orta		virtualenv: virtualenv: Arbitrary code execution via insecure cached file permissions07:11 UTC derlemesi
CVE-2026-113719
orta		virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata07:11 UTC derlemesi
CVE-2026-113718
orta		virtualenv: virtualenv: arbitrary code execution via improper quoting in xonsh activation scripts07:11 UTC derlemesi
CVE-2026-113717
orta		virtualenv: virtualenv: Integrity verification bypass via pip seeder download option07:11 UTC derlemesi
CVE-2026-113716
orta		virtualenv: virtualenv: Unauthorized file write via symlink following07:11 UTC derlemesi
CVE-2026-113715
orta		virtualenv: virtualenv: Environment isolation bypass via crafted destination path07:11 UTC derlemesi
CVE-2026-113714
orta		virtualenv: virtualenv: Unverified package installation via premature cache storage07:11 UTC derlemesi
CVE-2026-113713
orta		virtualenv: virtualenv: Arbitrary code execution via insecure temporary cache symlinks07:11 UTC derlemesi
CVE-2026-113712
orta		Cachet has Stored XSS in Incident Component07:11 UTC derlemesi
CVE-2026-113710
orta		ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing07:11 UTC derlemesi
CVE-2026-113671
orta		ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF07:11 UTC derlemesi
CVE-2026-113669
orta		ApostropheCMS: Cross-domain session token in URL confers session takeover07:11 UTC derlemesi
CVE-2026-113668
orta		ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)07:11 UTC derlemesi
CVE-2026-113667
orta		ApostropheCMS: CAPTCHA response token not URL-encoded07:11 UTC derlemesi
CVE-2026-113664
orta		ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test07:11 UTC derlemesi
CVE-2026-113662
orta		ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document07:11 UTC derlemesi
CVE-2026-113661
orta		sanitize-html: sanitize-html: Cross-site scripting via unsafe meta refresh content attributes07:11 UTC derlemesi
CVE-2026-113660
orta		ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers07:11 UTC derlemesi
CVE-2026-113659
orta		ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users07:11 UTC derlemesi
CVE-2026-113656
orta		ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS07:11 UTC derlemesi
CVE-2026-113655
orta		ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization07:11 UTC derlemesi
CVE-2026-113654
orta		sanitize-html: sanitize-html: HTML sanitization bypass via improper noscript tag handling07:11 UTC derlemesi
CVE-2026-113653
orta		ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)07:11 UTC derlemesi
CVE-2026-113652
orta		ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)07:11 UTC derlemesi
CVE-2026-113650
orta		sanitize-html: sanitize-html: Denial of Service via unbounded recursion in iframe tag processing07:11 UTC derlemesi
CVE-2026-113649
orta		ApostropheCMS: Import API bypasses publication roles for protected content07:11 UTC derlemesi
CVE-2026-112958
orta		ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization07:11 UTC derlemesi
CVE-2026-112957
orta		ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users07:11 UTC derlemesi
CVE-2026-113602
orta		net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode07:11 UTC derlemesi
CVE-2026-112956
orta		ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content07:11 UTC derlemesi
CVE-2026-112955
orta		ApostropheCMS: Import archives can exhaust server storage and deny service07:11 UTC derlemesi
CVE-2026-112954
orta		ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API07:11 UTC derlemesi
CVE-2026-112953
orta		ApostropheCMS: Exposure of Sensitive Information via predictable export filenames07:11 UTC derlemesi
CVE-2026-112952
orta		ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user07:11 UTC derlemesi
CVE-2026-112951
orta		ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix07:11 UTC derlemesi
CVE-2026-112950
orta		Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix07:11 UTC derlemesi
CVE-2026-112949
orta		vitest: Vitest: Cross-site scripting via unescaped mock module URL07:11 UTC derlemesi
CVE-2026-112948
orta		vitest: vitest: Information disclosure via improper file access restrictions07:11 UTC derlemesi
CVE-2026-112947
orta		vite: vite: Information disclosure via crafted WebAssembly query parameter07:11 UTC derlemesi
CVE-2026-112945
orta		vite: vite: Arbitrary script execution via improper URL handling during HTML transformation07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.