Zafiyetler
Gate'in zaten bildiği kritik zafiyetler.
Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.
Database son güncelleme27 Eki 2026, 13:12 UTC
23kritik, son 7 gün298yüksek, son 7 gün633orta, son 7 gün139düşük, son 7 gün| ID | Zafiyet | Önem derecesi kaynağı / ekosistemler | Kritik olduğu tarih | Yayın |
|---|---|---|---|---|
| CVE-2026-107282 kritik | org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostasync-http-client, org.asynchttpclient:async-http-client, druid ve 6 tane daha | GHSA, Red HatGHSA 9.4chainguard, seal maven, debian, minimos, rapidfort debian +4 | 07:11 UTC derlemesi | |
| CVE-2026-62253 kritik | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)github.com/sipcapture/homer-app | GHSAGHSA 9.8go | 07:11 UTC derlemesi | |
| CVE-2026-62252 kritik | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Logingithub.com/sipcapture/homer-app | GHSAGHSA 9.8go | 07:11 UTC derlemesi | |
| CVE-2026-62176 kritik | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generationpraisonai | GHSAGHSA 9.1pip | 07:11 UTC derlemesi | |
| CVE-2026-92414 kritik | : Session Fixation / Session Reuse across Users vulnerability in Apach ...jackrabbit | NVDNVD 9.1debian, rapidfort debian, echo | 07:11 UTC derlemesi | |
| CVE-2026-105192 kritik | LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportkserve-huggingfaceserver-cuda-13.3, lmcache, lmcache-cuda-13.0 | GHSAGHSA 9.8chainguard, pip | 07:11 UTC derlemesi | |
| CVE-2026-81535 kritik | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel…wolfssh | NVDNVD 9.1alpine | 07:11 UTC derlemesi | |
| CVE-2026-106486 kritik | plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server | NVDNVD 9.9npm | 07:11 UTC derlemesi | |
| CVE-2026-95106 kritik | Gitea review and execution mismatch through duplicate tree entriesgitea, gitea-fips | BitnamiBitnami 9.1rapidfort alpine, minimos, bitnami | 07:11 UTC derlemesi | |
| CVE-2026-73278 kritik | Gitea WebAuthn bypass during OAuth and OIDC sign-ingitea, gitea-fips | BitnamiBitnami 9.8rapidfort alpine, minimos, alpine, bitnami | 07:11 UTC derlemesi | |
| CVE-2026-106237 kritik | chromium-browser: Information leak in Permissionschromium, chromedriver, chromium-common ve 3 tane daha | NVDNVD 9.6rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | 07:11 UTC derlemesi | |
| CVE-2026-106195 kritik | chromium-browser: Incorrect authorization in Chromotingchromium, chromedriver, chromium-common ve 3 tane daha | NVDNVD 9.1rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | 07:11 UTC derlemesi | |
| CVE-2026-106102 kritik | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasar | GHSAGHSA 10.0npm | 07:11 UTC derlemesi | |
| CVE-2026-105863 kritik | Payload authentication token field handling issuepayload | NVD, GHSANVD 9.4npm | 07:11 UTC derlemesi | |
| CVE-2026-105859 kritik | Payload: Unauthorized update to collection documentspayload | GHSAGHSA 9.8npm | 07:11 UTC derlemesi | |
| CVE-2026-105857 kritik | Payload Form Builder has an RCE issue@payloadcms/plugin-form-builder | GHSAGHSA 10.0npm | 07:11 UTC derlemesi | |
| CVE-2026-105848 kritik | Payload: Insufficient Access Control in Stripe REST Proxy@payloadcms/plugin-stripe | NVDNVD 9.6npm | 07:11 UTC derlemesi | |
| CVE-2026-105845 kritik | Payload: SQL Injection in SQLite and Postgrespayload | GHSAGHSA 9.8npm | 07:11 UTC derlemesi | |
| CVE-2026-105844 kritik | Payload: Prototype pollution in Payload Import Export plugin@payloadcms/plugin-import-export | GHSAGHSA 9.3npm | 07:11 UTC derlemesi | |
| CVE-2026-105794 kritik | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLMicrosoft.Native.Quic.MsQuic.OpenSSL, microsoft.native.quic.msquic.openssl | GHSAGHSA 9.1nuget | 07:11 UTC derlemesi | |
| CVE-2026-105697 kritik | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationlangflow, langflow-base, lfx | GHSAGHSA 10.0pip | 07:11 UTC derlemesi | |
| GHSA-v2f8-6655-7grj kritik | Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainvibe-trading-ai | GHSAGHSA 10.0pip | 07:11 UTC derlemesi | |
| GHSA-jqmf-mx4f-hfr6 kritik | Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFvibe-trading-ai | GHSAGHSA 10.0pip | 07:11 UTC derlemesi | |
| GHSA-gg6r-gp4c-89hp kritik | Trigger.dev: V1 coordinator default-secret unauth Socket.IOtrigger.dev | GHSAGHSA 9.2npm | 07:11 UTC derlemesi | |
| CVE-2026-103922 kritik | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path@capacitor/android, @capacitor/ios, com.capacitorjs:core ve 1 tane daha | GHSAGHSA 9.3npm, maven, swift | 07:11 UTC derlemesi | |
| CVE-2026-101276 kritik | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use- ...iperf3, iperf, iperf-doc | Photon OSPhoton OS, debian, rapidfort debian, alpine | 07:11 UTC derlemesi | |
| CVE-2026-55107 kritik | kobako Sandbox Escape - guest eval reaches host RCE via method_missing → public_send (any bound Service)kobako | GHSA, Ruby Advisory DBGHSA 10.0rubygems | 07:11 UTC derlemesi | |
| GHSA-vcvr-r3jv-pc5j kritik | Next.js: Remote Code Execution in next/og ImageResponsenext | GHSAGHSA 9.5echo npm, npm | 07:11 UTC derlemesi | |
| CVE-2026-102828 kritik | simple-git: simple-git unsafe-operation guard does not block trailer command configurationgrafana, grafana-selinux, renovate ve 5 tane daha | NVD, GHSANVD 9.8rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, rapidfort rocky, Red Hat +6 | 07:11 UTC derlemesi | |
| CVE-2026-102827 kritik | simple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)renovate, simple-git, @seal-security/simple-git ve 17 tane daha | NVDNVD 9.8Red Hat, chainguard, minimos, seal npm, npm +1 | 07:11 UTC derlemesi | |
| CVE-2026-102560 kritik | libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growthlibsoup3, libsoup, libsoup2.4 ve 7 tane daha | NVDNVD 9.8rapidfort ubuntu, ubuntu, rapidfort debian, debian, alma +10 | 07:11 UTC derlemesi | |
| CVE-2026-102676 kritik | electron: electron: Privilege escalation via unauthorized Node.js integration in web workerselectron | NVDNVD 9.8npm | 07:11 UTC derlemesi | |
| CVE-2026-102268 kritik | pyjwt: PyJWT: Authentication bypass via improper public key validationpyjwt, fence-agents-aliyun, fence-agents-all ve 147 tane daha | GHSA, Red Hat, Azure Linux, Photon OSGHSA 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +16 | 07:11 UTC derlemesi | |
| CVE-2026-102267 kritik | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirectspyjwt, fence-agents-aliyun, fence-agents-all ve 157 tane daha | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, chainguard +16 | 07:11 UTC derlemesi | |
| CVE-2026-102266 kritik | pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptancefence-agents-aliyun, fence-agents-all, fence-agents-aws ve 142 tane daha | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +15 | 07:11 UTC derlemesi |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.