Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-105642
yüksek		Ghost: Remote Code Execution via Bookmark Card Images07:11 UTC derlemesi
CVE-2026-104714
yüksek		Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Stru07:11 UTC derlemesi
CVE-2026-104712
yüksek		org.apache.struts/struts2-core: Apache Struts: Denial of Service via resource amplification in tag library07:11 UTC derlemesi
CVE-2026-104711
yüksek		org.apache.struts/struts2-core: Apache Struts: Arbitrary code execution via expression injection in legacy RESTful action mapper07:11 UTC derlemesi
CVE-2026-93320
yüksek		github.com/moby/buildkit: BuildKit: Unintended host device access via special file inodes07:11 UTC derlemesi
CVE-2026-93318
yüksek		github.com/moby/buildkit: BuildKit: arbitrary code execution via cache poisoning from mismatched layer identifiers07:11 UTC derlemesi
CVE-2026-101919
yüksek		hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane07:11 UTC derlemesi
CVE-2026-102282
yüksek		adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives07:11 UTC derlemesi
CVE-2026-104891
yüksek		mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control07:11 UTC derlemesi
CVE-2026-104890
yüksek		Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution07:11 UTC derlemesi
CVE-2026-63277
yüksek		libreoffice: libreoffice: Arbitrary code execution via remote Java database driver07:11 UTC derlemesi
CVE-2026-19395
yüksek		qt-mcu: qt: Denial of Service via empty image tag attribute in styled text07:11 UTC derlemesi
CVE-2026-105221
yüksek		gist: gist: Traffic interception and credential theft via improper TLS certificate validation07:11 UTC derlemesi
CVE-2026-71889
yüksek		org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks07:11 UTC derlemesi
CVE-2026-71888
yüksek		bouncycastle: bouncycastle-fips: Bouncy Castle: Security bypass via unvalidated attributes in CMS AuthenticatedData parser07:11 UTC derlemesi
GHSA-x8gv-g2g3-65fj
yüksek		SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)07:11 UTC derlemesi
GHSA-cjcg-cxmh-9wcr
yüksek		Praxis affected by HTTP/2 Bomb07:11 UTC derlemesi
GHSA-5rmq-chc7-m22f
yüksek		Vibe-Trading file-read tools expose arbitrary server-readable files07:11 UTC derlemesi
GHSA-9q4r-4842-93vw
yüksek		Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name07:11 UTC derlemesi
GHSA-pqxw-g93w-hj9x
yüksek		Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise07:11 UTC derlemesi
GHSA-5wf9-h793-w73c
yüksek		Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks07:11 UTC derlemesi
GHSA-pp95-gc86-jq6q
yüksek		Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)07:11 UTC derlemesi
CVE-2026-104988
yüksek		pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject07:11 UTC derlemesi
CVE-2026-104873
yüksek		langgraph-sdk: langgraph-sdk: Authorization bypass via improper resource handler registration07:11 UTC derlemesi
GHSA-xxv7-2vv3-h682
yüksek		Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL07:11 UTC derlemesi
GHSA-qxpp-qjg8-x4jv
yüksek		Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)07:11 UTC derlemesi
GHSA-8mcx-5rqc-vhmf
yüksek		Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths07:11 UTC derlemesi
GHSA-8w8g-wq8h-fq33
yüksek		Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections07:11 UTC derlemesi
GHSA-5fqc-mrg8-w798
yüksek		Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence07:11 UTC derlemesi
GHSA-cm62-gvxx-vmxx
yüksek		Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks07:11 UTC derlemesi
CVE-2026-104861
yüksek		probe-image-size: probe-image-size: Denial of Service via crafted SVG input07:11 UTC derlemesi
CVE-2026-104859
yüksek		@nx/docker: OS command injection in the @nx/docker release pipeline07:11 UTC derlemesi
CVE-2026-104854
yüksek		nx: Nx: Arbitrary code execution via insecure socket permissions07:11 UTC derlemesi
CVE-2026-104851
yüksek		fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem07:11 UTC derlemesi
CVE-2026-104848
yüksek		tinypool: tinypool: arbitrary code execution via prototype pollution in worker options07:11 UTC derlemesi
CVE-2026-67989
yüksek		Polynomial-Time Regular Expression Denial of Service (ReDoS) vulnerability07:11 UTC derlemesi
CVE-2026-104847
yüksek		ProseMirror has a XSS vulnerability in prosemirror-view's paste handling07:11 UTC derlemesi
CVE-2026-104846
yüksek		seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)07:11 UTC derlemesi
CVE-2026-104845
yüksek		seroval: seroval: Denial of Service via unbounded memory allocation during deserialization07:11 UTC derlemesi
CVE-2026-104843
yüksek		uv: uv: Arbitrary code execution via malicious package extraction on Windows07:11 UTC derlemesi
CVE-2026-103631
yüksek		chromium-browser: Buffer overflow in WebRTC07:11 UTC derlemesi
CVE-2026-103630
yüksek		chromium-browser: Use after free in FedCM07:11 UTC derlemesi
CVE-2026-103629
yüksek		chromium-browser: skia: Integer overflow in Skia07:11 UTC derlemesi
CVE-2026-103628
yüksek		chromium-browser: Out of bounds write in WebGL07:11 UTC derlemesi
CVE-2026-103626
yüksek		chromium-browser: Incorrect authorization in FileSystem07:11 UTC derlemesi
CVE-2026-103625
yüksek		chromium-browser: Type confusion in V807:11 UTC derlemesi
CVE-2026-103624
yüksek		chromium-browser: Use after free in Contextual Tasks07:11 UTC derlemesi
CVE-2026-103623
yüksek		chromium-browser: Use after free in MediaStream07:11 UTC derlemesi
CVE-2026-103622
yüksek		chromium-browser: Use after free in SVG07:11 UTC derlemesi
CVE-2026-103621
yüksek		chromium-browser: Integer overflow in Compositing07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.