Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-94633
yüksek		thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings07:11 UTC derlemesi
CVE-2026-93926
yüksek		thrift: thrift: Denial of Service via memory leak in THeaderTransport07:11 UTC derlemesi
CVE-2026-93925
yüksek		thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol07:11 UTC derlemesi
CVE-2026-91137
yüksek		thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements07:11 UTC derlemesi
CVE-2026-91135
yüksek		thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression07:11 UTC derlemesi
CVE-2026-85494
yüksek		thrift: thrift: Denial of Service via improper message handling in language bindings07:11 UTC derlemesi
CVE-2026-85493
yüksek		thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)07:11 UTC derlemesi
CVE-2026-94639
yüksek		improper handling of exceptional conditions, Allocation of resources w ...07:11 UTC derlemesi
CVE-2026-94635
yüksek		thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings07:11 UTC derlemesi
CVE-2026-94634
yüksek		thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default07:11 UTC derlemesi
CVE-2026-103885
yüksek		org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers07:11 UTC derlemesi
CVE-2026-103877
yüksek		org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization07:11 UTC derlemesi
CVE-2026-103552
yüksek		org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter07:11 UTC derlemesi
CVE-2026-102731
yüksek		org.apache.directory.api/api-asn1-ber: Apache Directory LDAP API: Denial of Service via excessive memory allocation07:11 UTC derlemesi
CVE-2026-17507
yüksek		In Bouncy Castle for Java before 1.86, the MLS implementation (org.bou ...07:11 UTC derlemesi
CVE-2026-86344
yüksek		389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-PDU connection requeue07:11 UTC derlemesi
CVE-2026-51886
yüksek		Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description07:11 UTC derlemesi
CVE-2026-96780
yüksek		figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width07:11 UTC derlemesi
CVE-2026-54049
yüksek		Sakai Conversations has a Stored XSS Issue07:11 UTC derlemesi
CVE-2026-53964
yüksek		Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)07:11 UTC derlemesi
CVE-2026-103484
yüksek		pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build07:11 UTC derlemesi
CVE-2026-15911
yüksek		confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration07:11 UTC derlemesi
CVE-2026-12542
yüksek		foreman: command injection in foreman-tail07:11 UTC derlemesi
CVE-2023-54404
yüksek		zod: zod: Denial of service via unbounded array validation07:11 UTC derlemesi
CVE-2026-96659
yüksek		foreman: Excessive Permissions for Viewer Role on Preview07:11 UTC derlemesi
CVE-2026-96658
yüksek		foreman: Foreman: Arbitrary code execution via safemode sandbox bypass07:11 UTC derlemesi
CVE-2026-73636
yüksek		httpd: httpd: Authentication bypass via credential replay in mod_auth_digest07:11 UTC derlemesi
CVE-2026-63718
yüksek		httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi07:11 UTC derlemesi
CVE-2026-63686
yüksek		httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc07:11 UTC derlemesi
CVE-2026-63292
yüksek		httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias07:11 UTC derlemesi
CVE-2026-59685
yüksek		httpd: httpd: Denial of Service via out-of-bounds write during Windows path expansion07:11 UTC derlemesi
CVE-2026-56154
yüksek		httpd: httpd: Denial of Service via mod_rewrite lookahead07:11 UTC derlemesi
CVE-2026-56153
yüksek		httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite07:11 UTC derlemesi
CVE-2026-12544
yüksek		foreman: SSTI and insecure deserialization in foreman-rake configuration07:11 UTC derlemesi
CVE-2026-12541
yüksek		foreman: command injection in foreman-rake database tasks07:11 UTC derlemesi
CVE-2026-12540
yüksek		foreman: command injection in foreman-rake errors:fetch_log via request_id parameter07:11 UTC derlemesi
CVE-2026-12423
yüksek		foreman: unauthenticated information disclosure via provisioning token validation flaw07:11 UTC derlemesi
CVE-2026-12405
yüksek		rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter07:11 UTC derlemesi
CVE-2026-103921
yüksek		GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor07:11 UTC derlemesi
GHSA-9cqf-hhrq-7v45
yüksek		SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route07:11 UTC derlemesi
CVE-2026-46729
yüksek		httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference07:11 UTC derlemesi
GHSA-mcm9-63f2-9j32
yüksek		devalue: Repeated primitive strings cause quadratic expansion in uneval07:11 UTC derlemesi
GHSA-r9w8-h9r3-54w4
yüksek		devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation07:11 UTC derlemesi
GHSA-x5rw-q4pp-hg5g
yüksek		devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise07:11 UTC derlemesi
CVE-2026-94250
yüksek		Apache APISIX: Batch response aggregation can exhaust worker memory07:11 UTC derlemesi
CVE-2026-103678
yüksek		A flaw was found in tnef. An attacker can exploit this vulnerability b ...07:11 UTC derlemesi
CVE-2026-103292
yüksek		Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head07:11 UTC derlemesi
CVE-2026-103289
yüksek		Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments07:11 UTC derlemesi
CVE-2026-103286
yüksek		Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications07:11 UTC derlemesi
CVE-2026-103283
yüksek		Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.