Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-109311
orta		vllm: vLLM: Denial of Service via crafted IAMF audio file upload07:11 UTC derlemesi
CVE-2026-109303
orta		Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query07:11 UTC derlemesi
CVE-2026-109302
orta		Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries07:11 UTC derlemesi
CVE-2026-109281
orta		ImageMagick: ImageMagick: Information disclosure via crafted -fx expression07:11 UTC derlemesi
CVE-2026-109276
orta		ImageMagick: ImageMagick: Denial of Service via temporary file leak in JNG decoder07:11 UTC derlemesi
CVE-2026-109275
orta		ImageMagick: ImageMagick: Code injection via crafted MVG file07:11 UTC derlemesi
CVE-2026-109269
orta		ImageMagick: ImageMagick: Information disclosure via crafted JPEG file07:11 UTC derlemesi
CVE-2026-109265
orta		ImageMagick: ImageMagick: Denial of Service via malformed XMP profile07:11 UTC derlemesi
CVE-2026-109262
orta		ImageMagick: ImageMagick: Denial of Service via memory leak in SVG encoder07:11 UTC derlemesi
CVE-2026-109259
orta		ImageMagick: ImageMagick: Information disclosure via crafted TGA image07:11 UTC derlemesi
CVE-2026-109256
orta		freerdp: FreeRDP: Denial of Service via heap buffer overflow during clipboard image conversion07:11 UTC derlemesi
CVE-2026-109255
orta		freerdp: freerdp: Arbitrary code execution via integer truncation in license stream validation07:11 UTC derlemesi
CVE-2026-109254
orta		freerdp: freerdp: Denial of Service via use-after-free during audio channel disconnect07:11 UTC derlemesi
CVE-2026-109253
orta		freerdp: freerdp: Denial of Service via out-of-bounds read in RDPEAR07:11 UTC derlemesi
CVE-2026-109252
orta		freerdp: freerdp: Denial of Service via truncated authentication data07:11 UTC derlemesi
CVE-2026-109251
orta		freerdp: FreeRDP: Denial of Service via invalid video geometry coordinates07:11 UTC derlemesi
CVE-2026-109250
orta		freerdp: FreeRDP: arbitrary code execution via heap buffer overflow during smartcard key enumeration07:11 UTC derlemesi
CVE-2026-109249
orta		freerdp: FreeRDP: Denial of Service via crafted Remote Assistance file07:11 UTC derlemesi
CVE-2026-109248
orta		freerdp: freerdp: Denial of Service via heap out-of-bounds read in clipboard handling07:11 UTC derlemesi
CVE-2026-109246
orta		freerdp: freerdp: Denial of Service via divide-by-zero error in shadow server07:11 UTC derlemesi
CVE-2026-109245
orta		freerdp: freerdp: Information disclosure via improper TLS certificate validation07:11 UTC derlemesi
CVE-2026-109244
orta		freerdp: freerdp: Information disclosure via insecure file permissions in winpr-makecert07:11 UTC derlemesi
CVE-2026-109243
orta		freerdp: freerdp: Information disclosure via insecure private key permissions07:11 UTC derlemesi
CVE-2026-96618
orta		hex: hex: Denial of Service via unconstrained data decompression07:11 UTC derlemesi
CVE-2026-81856
orta		hex: hex: Terminal output spoofing via unescaped control sequences07:11 UTC derlemesi
CVE-2026-109194
orta		quay: Build trigger UUID IDOR in Quay API07:11 UTC derlemesi
CVE-2026-105668
orta		hex: hex: Release cooldown protection bypass via retired package releases07:11 UTC derlemesi
CVE-2026-105280
orta		hex: hex: Integrity check bypass via standard output package fetch07:11 UTC derlemesi
CVE-2026-103503
orta		hex: hex: Host impersonation via improper CA certificate store validation07:11 UTC derlemesi
CVE-2026-103502
orta		hex_core: hex_core: Server impersonation via improper TLS certificate validation07:11 UTC derlemesi
CVE-2026-109082
orta		keycloak-services: keycloak-services: CIBA confidential-only contract not enforced for public clients07:11 UTC derlemesi
CVE-2026-98385
orta		kernel: sched/cache: Decouple sched_cache_group from mm to fix UAF07:11 UTC derlemesi
CVE-2026-107203
orta		foreman: domain and subnet interface API skips host search filters07:11 UTC derlemesi
CVE-2026-107193
orta		foreman: API filter lookup ignores a search-limited filter permission07:11 UTC derlemesi
CVE-2026-108858
orta		lorax: lorax: Information disclosure via API token logging07:11 UTC derlemesi
CVE-2026-108752
orta		JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ...07:11 UTC derlemesi
CVE-2026-108575
orta		litellm: LiteLLM: Improper authorization via api_key parameter manipulation07:11 UTC derlemesi
CVE-2026-108574
orta		litellm: litellm: Authorization bypass via session identifier manipulation07:11 UTC derlemesi
CVE-2026-108573
orta		assimp: assimp: Denial of Service via out-of-bounds read in PLY file handler07:11 UTC derlemesi
CVE-2026-108693
orta		ImageMagick: ImageMagick: Arbitrary code execution via insecure search path07:11 UTC derlemesi
CVE-2026-108597
orta		cohere: cohere: Arbitrary file overwrite via path traversal in archive extraction07:11 UTC derlemesi
CVE-2026-17025
orta		graphene: graphene: Stored Cross-Site Scripting via profile fields07:11 UTC derlemesi
CVE-2026-108258
orta		Shiny for Python has path traversal in bookmark restore07:11 UTC derlemesi
CVE-2026-107851
orta		Contao: Improper access control in the table access voter07:11 UTC derlemesi
CVE-2026-107850
orta		Contao: Improper access control in the preview links module07:11 UTC derlemesi
GHSA-fmmf-xq98-g327
orta		Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check07:11 UTC derlemesi
GHSA-pjr3-86v4-5p7w
orta		Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)07:11 UTC derlemesi
GHSA-hjx8-qv73-f7cm
orta		Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed07:11 UTC derlemesi
GHSA-fprf-r6rv-xg99
orta		Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants07:11 UTC derlemesi
GHSA-4hv6-xc92-j86g
orta		Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.