Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
GHSA-8wvg-r2j4-3737
orta		Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint07:11 UTC derlemesi
GHSA-3hc7-r24j-rpwc
orta		Vikunja: Cross-project task disclosure through subtask expansion07:11 UTC derlemesi
GHSA-g38j-7v97-x298
orta		Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID07:11 UTC derlemesi
CVE-2026-107844
orta		Contao: Path traversal in the images controller07:11 UTC derlemesi
CVE-2026-107843
orta		Contao: The registration module re-sends activation mails07:11 UTC derlemesi
CVE-2026-107842
orta		Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled07:11 UTC derlemesi
CVE-2026-107841
orta		pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents07:11 UTC derlemesi
CVE-2026-107834
orta		Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor07:11 UTC derlemesi
CVE-2026-107833
orta		Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion07:11 UTC derlemesi
CVE-2026-107825
orta		Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations07:11 UTC derlemesi
CVE-2026-107822
orta		mariadb: MariaDB: Privilege escalation via ACL cache key collision07:11 UTC derlemesi
CVE-2026-107821
orta		mariadb: mariadb: Arbitrary code execution via crafted FRM metadata07:11 UTC derlemesi
CVE-2026-107816
orta		mariadb: mariadb: Information disclosure via embedded null bytes in query cache plugin07:11 UTC derlemesi
CVE-2026-75597
orta		pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo07:11 UTC derlemesi
CVE-2026-48484
orta		pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination07:11 UTC derlemesi
CVE-2026-108119
orta		busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix07:11 UTC derlemesi
CVE-2026-108093
orta		GIMP: gimp: Denial of service via NULL pointer dereference in XCF simulation parasite loading07:11 UTC derlemesi
GHSA-9q47-3cm2-2rp8
orta		pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header07:11 UTC derlemesi
GHSA-p3pr-8f3m-4qp8
orta		pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host07:11 UTC derlemesi
CVE-2026-108104
orta		org.xerial.snappy/snappy-java: snappy-java: information disclosure via double release of pooled buffers07:11 UTC derlemesi
CVE-2026-107804
orta		Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout07:11 UTC derlemesi
CVE-2026-108063
orta		A flaw was found in libhangul. When parsing Hanja dictionary files, th ...07:11 UTC derlemesi
CVE-2026-71884
orta		org.bouncycastle:bcprov-lts8on: bouncycastle: Information disclosure via keystream reuse in native CTR cipher07:11 UTC derlemesi
CVE-2026-107655
orta		cups: NULL pointer dereference via embedded job ticket comments allows remote denial of service07:11 UTC derlemesi
CVE-2026-104635
orta		protobuf: protobuf: Denial of Service via deeply nested JSON input07:11 UTC derlemesi
CVE-2026-98384
orta		kernel: bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()07:11 UTC derlemesi
CVE-2026-98383
orta		kernel: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL07:11 UTC derlemesi
CVE-2026-98382
orta		kernel: bpf: Reject dev-bound-only programs on other devices07:11 UTC derlemesi
CVE-2026-98381
orta		kernel: veth: manage XDP program pointers during channel resize07:11 UTC derlemesi
CVE-2026-98380
orta		kernel: net/sched: reject IDR error pointers when deleting actions07:11 UTC derlemesi
CVE-2026-98379
orta		kernel: netfilter: ip6t_rpfilter: reject routes without inet6_dev07:11 UTC derlemesi
CVE-2026-98377
orta		kernel: vlan: require the MAC header to be present in __vlan_insert_inner_tag()07:11 UTC derlemesi
CVE-2026-98376
orta		kernel: bpf: Use array_map_meta_equal for percpu array inner map replacement07:11 UTC derlemesi
CVE-2026-98375
orta		kernel: xen/netfront: drop RX packets with a short Ethernet header07:11 UTC derlemesi
CVE-2026-101028
orta		ash: Ash: Information disclosure via missing authorization checks in aggregate queries07:11 UTC derlemesi
CVE-2026-107890
orta		cups: cups: Denial of Service via repeated IPP group tags07:11 UTC derlemesi
CVE-2026-107889
orta		keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass07:11 UTC derlemesi
CVE-2026-107888
orta		cups: CUPS: Denial of Service via deleted temporary printer07:11 UTC derlemesi
CVE-2026-107886
orta		cups: cups: Denial of Service via double-free in printer class management07:11 UTC derlemesi
CVE-2026-107885
orta		cups: cups: Denial of Service via improper job submission timeout handling07:11 UTC derlemesi
CVE-2026-97032
orta		net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification07:11 UTC derlemesi
CVE-2026-97030
orta		html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword07:11 UTC derlemesi
CVE-2026-94448
orta		html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals07:11 UTC derlemesi
CVE-2026-94447
orta		cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration07:11 UTC derlemesi
CVE-2026-94444
orta		cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy07:11 UTC derlemesi
CVE-2026-94440
orta		net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing07:11 UTC derlemesi
CVE-2026-94439
orta		net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses07:11 UTC derlemesi
CVE-2026-78663
orta		net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server07:11 UTC derlemesi
CVE-2026-78660
orta		net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers07:11 UTC derlemesi
CVE-2026-78659
orta		net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.