Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-109716
orta		Incorrect boundary conditions in the JavaScript Engine component. This ...07:11 UTC derlemesi
CVE-2026-109715
orta		Incorrect boundary conditions in the JavaScript Engine component. This ...07:11 UTC derlemesi
CVE-2026-109713
orta		Use-after-free in the Crash Reporting component. This vulnerability wa ...07:11 UTC derlemesi
CVE-2026-109712
orta		Sandbox escape due to uninitialized memory in the Graphics component. ...07:11 UTC derlemesi
CVE-2026-109711
orta		Use-after-free in the Graphics: Canvas2D component. This vulnerability ...07:11 UTC derlemesi
CVE-2026-109709
orta		Information disclosure, privilege escalation in the Security: Process ...07:11 UTC derlemesi
CVE-2026-109708
orta		Sandbox escape due to incorrect boundary conditions in the Networking ...07:11 UTC derlemesi
CVE-2026-109704
orta		ELSA-2026-89758: firefox security, bug fix, and enhancement update (IMPORTANT)07:11 UTC derlemesi
CVE-2026-109156
orta		mlserver: MLServer: Arbitrary file write via path traversal in environment archive extraction07:11 UTC derlemesi
CVE-2026-109152
orta		scp: scp.py: Arbitrary file overwrite via path traversal07:11 UTC derlemesi
CVE-2026-9268
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-92528
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-85529
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-84284
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-7767
orta		URL Redirection to Untrusted Site ('Open Redirect') in GitLab07:11 UTC derlemesi
CVE-2026-78335
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-6567
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-5954
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-16275
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-14552
orta		Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-14210
orta		Insufficient Granularity of Access Control in GitLab07:11 UTC derlemesi
CVE-2026-105458
orta		Reliance on Untrusted Inputs in a Security Decision in GitLab07:11 UTC derlemesi
CVE-2026-104661
orta		Incorrect Privilege Assignment in GitLab07:11 UTC derlemesi
CVE-2026-101168
orta		Insertion of Sensitive Information into Log File in GitLab07:11 UTC derlemesi
CVE-2026-100755
orta		Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab07:11 UTC derlemesi
CVE-2026-109597
orta		hugo: Hugo: Stored cross-site scripting via crafted heading identifiers07:11 UTC derlemesi
CVE-2026-109596
orta		hugo: Hugo: Information disclosure via improper link resolution in nested mounts07:11 UTC derlemesi
CVE-2026-109595
orta		hugo: Hugo: Information disclosure via path traversal during asset compilation07:11 UTC derlemesi
CVE-2026-109574
orta		hugo: Hugo: Information disclosure via Sass import path traversal07:11 UTC derlemesi
CVE-2026-84321
orta		Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable07:11 UTC derlemesi
CVE-2026-84320
orta		Nginx UI: Auto backup name allows path traversal outside validated storage path07:11 UTC derlemesi
CVE-2026-41508
orta		Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling07:11 UTC derlemesi
CVE-2026-41504
orta		Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields07:11 UTC derlemesi
CVE-2026-109561
orta		goose: goose: Authorization bypass via uncleared read-only tool annotations07:11 UTC derlemesi
CVE-2026-106495
orta		Backstage: Improper access control in backend action invocation07:11 UTC derlemesi
CVE-2026-104774
orta		Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass07:11 UTC derlemesi
CVE-2026-85471
orta		quay: quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable07:11 UTC derlemesi
CVE-2026-83536
orta		openstack-network-exporter: http.Server has no ReadHeaderTimeout / ReadTimeout (Slowloris)07:11 UTC derlemesi
CVE-2026-83535
orta		openstack-network-exporter: Basic-auth uses plaintext password storage and non-constant-time comparison07:11 UTC derlemesi
CVE-2026-107226
orta		The AsyncHttpClient (AHC) library allows Java applications to easily e ...07:11 UTC derlemesi
CVE-2026-104355
orta		go.temporal.io/server: Temporal Server: Unauthorized modification of local namespaces via inbound replication tasks07:11 UTC derlemesi
CVE-2026-104102
orta		copyparty FTP: upload outside defined volumes (limited path traversal)07:11 UTC derlemesi
CVE-2026-77364
orta		obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default07:11 UTC derlemesi
CVE-2026-109448
orta		postgresql-odbc: postgresql-odbc: Denial of Service via integer wraparound in SQLBindParameter07:11 UTC derlemesi
CVE-2026-94451
orta		quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache07:11 UTC derlemesi
CVE-2026-109351
orta		gix-pack: gix-pack: Denial of Service via crafted pack-header object count07:11 UTC derlemesi
CVE-2026-109350
orta		gix-pack: gix-pack: Denial of Service via malformed packfile delta entries07:11 UTC derlemesi
CVE-2026-109349
orta		gix-pack: gix-pack: Denial of Service via crafted pack header07:11 UTC derlemesi
CVE-2026-109345
orta		dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode07:11 UTC derlemesi
CVE-2026-109344
orta		dompurify: DOMPurify: Cross-Site Scripting via unneutralized elements detached during in-place sanitization07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.