Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-105866
yüksek		Payload: Unauthenticated account-lockout denial of service07:11 UTC derlemesi
CVE-2026-105865
yüksek		Payload: Incomplete validation during the upload file lifecycle07:11 UTC derlemesi
CVE-2026-105862
yüksek		Payload: Bypassed sanitization of user uploaded SVGs07:11 UTC derlemesi
CVE-2026-105861
yüksek		Payload external upload trust validation issue07:11 UTC derlemesi
CVE-2026-105860
yüksek		Payload has a tenant authorization bypass in Multi-Tenant Plugin07:11 UTC derlemesi
CVE-2026-105858
yüksek		Payload: Remote Code Execution through first-register07:11 UTC derlemesi
CVE-2026-105856
yüksek		Payload: SQL injection in SQLite/Postgres07:11 UTC derlemesi
CVE-2026-105855
yüksek		Payload didn't enforce field-level password update restrictions07:11 UTC derlemesi
CVE-2026-105854
yüksek		Payload: ReDoS in Multipart Content-Type Validation07:11 UTC derlemesi
CVE-2026-105852
yüksek		Payload relationship-query authorization bypass07:11 UTC derlemesi
CVE-2026-105850
yüksek		Payload Ecommerce has an order confirmation validation issue07:11 UTC derlemesi
CVE-2026-105849
yüksek		Payload vulnerable to API key disclosure through ordinary document reads07:11 UTC derlemesi
CVE-2026-104850
yüksek		@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials07:11 UTC derlemesi
CVE-2026-26287
yüksek		github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass07:11 UTC derlemesi
CVE-2026-105806
yüksek		Payload: Improper access control for MCP API keys07:11 UTC derlemesi
CVE-2026-105922
yüksek		vllm: vLLM: Denial of Service via crafted inference request with prompt embeddings07:11 UTC derlemesi
CVE-2026-105801
yüksek		openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation07:11 UTC derlemesi
CVE-2026-105796
yüksek		Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators07:11 UTC derlemesi
CVE-2026-105841
yüksek		lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode07:11 UTC derlemesi
CVE-2026-105840
yüksek		lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode07:11 UTC derlemesi
GHSA-wq5f-xc86-pv6w
yüksek		sharp : Vulnerability in librsvg dependency CVE-2026-9688907:11 UTC derlemesi
CVE-2026-98364
yüksek		kernel: xfrm: hold net_device reference under RCU in bundle creation07:11 UTC derlemesi
CVE-2026-98323
yüksek		kernel: RDMA/siw: Bound fragmented header copies by the remaining length07:11 UTC derlemesi
CVE-2026-98320
yüksek		kernel: netfilter: flowtable: hold reference on ct until flow is released07:11 UTC derlemesi
CVE-2026-98318
yüksek		kernel: smb: client: validate absolute native symlink targets before NT fixups07:11 UTC derlemesi
CVE-2026-98260
yüksek		kernel: exec: Cleanup POSIX timers right after de_thread()07:11 UTC derlemesi
CVE-2026-98256
yüksek		kernel: signal: Prevent exec() race07:11 UTC derlemesi
CVE-2026-98222
yüksek		kernel: KEYS: encrypted: fix integer overflow of datablob_len07:11 UTC derlemesi
CVE-2026-98171
yüksek		In the Linux kernel, the following vulnerability has been resolved: s ...07:11 UTC derlemesi
CVE-2026-105782
yüksek		scrapy: Scrapy: Denial of Service via crafted Referrer-Policy header07:11 UTC derlemesi
GHSA-w2vw-w76x-qr89
yüksek		Nx: OS command injection via git revisions and remote refs07:11 UTC derlemesi
CVE-2026-105759
yüksek		vllm: vLLM: Denial of service via arbitrary HTTP method tokens in metrics tracking07:11 UTC derlemesi
CVE-2026-104852
yüksek		@graphql-tools/utils: @graphql-tools/utils: Denial of Service (DoS) via prototype pollution in mergeDeep07:11 UTC derlemesi
GHSA-6w6g-hm98-mhgm
yüksek		hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)07:11 UTC derlemesi
GHSA-5j98-2g5x-46v6
yüksek		hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures07:11 UTC derlemesi
GHSA-g2v6-rqmx-r4w6
yüksek		@vue/server-renderer: XSS via missing CR in attribute-name blacklist07:11 UTC derlemesi
GHSA-v853-p72q-4cfw
yüksek		Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__07:11 UTC derlemesi
CVE-2026-105751
yüksek		docling: docling: Information disclosure via crafted OpenDocument image reference07:11 UTC derlemesi
CVE-2026-105750
yüksek		docling: docling: Information disclosure via unrestricted local file requests in HTML rendering07:11 UTC derlemesi
CVE-2026-105745
yüksek		docling: docling: Arbitrary code execution via premature plugin loading07:11 UTC derlemesi
CVE-2026-105744
yüksek		docling: docling: Arbitrary file read and write via unrestricted TeX primitives in Tectonic engine07:11 UTC derlemesi
CVE-2026-105741
yüksek		Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write07:11 UTC derlemesi
CVE-2026-105699
yüksek		Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers07:11 UTC derlemesi
CVE-2026-105679
yüksek		Ghost: Stored XSS via File Uploads on Local Storage07:11 UTC derlemesi
CVE-2026-105677
yüksek		Ghost: Remote Code Execution via Theme Translation Files07:11 UTC derlemesi
CVE-2026-105675
yüksek		Ghost: Invite Token Disclosure in Ghost Admin API07:11 UTC derlemesi
CVE-2026-105651
yüksek		Ghost: Stored XSS via Bookmark Card Images07:11 UTC derlemesi
CVE-2026-105650
yüksek		Ghost: Stored XSS via oEmbed Photo Responses07:11 UTC derlemesi
CVE-2026-105649
yüksek		Ghost: Stored XSS via SVG Uploads Bypassing Sanitization07:11 UTC derlemesi
CVE-2026-105643
yüksek		Ghost: Stored XSS via Embed Card Previews07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.