Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-56866
orta		net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections07:11 UTC derlemesi
CVE-2026-107651
orta		eog: eog: arbitrary code execution via heap buffer overflow in PNG metadata reader07:11 UTC derlemesi
CVE-2026-107721
orta		fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)07:11 UTC derlemesi
CVE-2026-107719
orta		fast-jwt: Verifier cache accepts expired JWTs without iat.07:11 UTC derlemesi
CVE-2026-107718
orta		http-server: http-server: Open redirect via unencoded route parameters07:11 UTC derlemesi
CVE-2026-107717
orta		banks: banks: Chat role injection via untrusted template input07:11 UTC derlemesi
CVE-2026-107715
orta		mechanize: mechanize: Information disclosure via cross-domain HTTP redirect07:11 UTC derlemesi
CVE-2026-107714
orta		mechanize: mechanize: Information disclosure via improper redirect scheme and port handling07:11 UTC derlemesi
CVE-2026-107399
orta		mechanize: mechanize: Information disclosure via cross-origin meta refresh07:11 UTC derlemesi
CVE-2026-107778
orta		krb5: krb5: Denial of Service via crafted forwarded credentials07:11 UTC derlemesi
CVE-2026-107708
orta		krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests07:11 UTC derlemesi
CVE-2026-107397
orta		Indico: Cross-Site-Scripting in minutes editor07:11 UTC derlemesi
CVE-2026-106435
orta		pymongo: pymongo: Denial of Service via out-of-bounds read during malformed BSON decoding07:11 UTC derlemesi
CVE-2026-107705
orta		poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption07:11 UTC derlemesi
CVE-2026-107396
orta		Indico: Cross-Site-Scripting in link fields07:11 UTC derlemesi
CVE-2026-107395
orta		Indico: Missing access check in legacy session export API07:11 UTC derlemesi
CVE-2026-107394
orta		Indico: Incomplete Server-Side Request Forgery (SSRF) check07:11 UTC derlemesi
CVE-2026-107389
orta		music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort07:11 UTC derlemesi
CVE-2026-106436
orta		php-pecl-mongodb: php-pecl-mongodb: Denial of Service via oversized BSON encoding07:11 UTC derlemesi
CVE-2026-95209
orta		gnutls: gnutls: legitimate CA certificates incorrectly rejected causing denial of service07:11 UTC derlemesi
CVE-2026-88648
orta		gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation07:11 UTC derlemesi
CVE-2026-67693
orta		gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions07:11 UTC derlemesi
CVE-2026-107388
orta		music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS07:11 UTC derlemesi
CVE-2026-107387
orta		music-metadata: Uncontrolled memory allocation in APEv2 parser07:11 UTC derlemesi
CVE-2026-107386
orta		github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via excessive memory allocation during frame parsing07:11 UTC derlemesi
CVE-2026-107382
orta		MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS07:11 UTC derlemesi
CVE-2026-107325
orta		go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via malformed BSON array input07:11 UTC derlemesi
CVE-2026-107324
orta		go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via integer overflow in BSON processing07:11 UTC derlemesi
CVE-2026-95210
orta		gnutls: gnutls: certificates with invalid extensions incorrectly accepted07:11 UTC derlemesi
CVE-2026-95184
orta		gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service07:11 UTC derlemesi
CVE-2026-93861
orta		openstack-mistral: mistral: workflow membership sub-delegation allows unauthorized access grant to private workflows07:11 UTC derlemesi
CVE-2026-93860
orta		openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service07:11 UTC derlemesi
CVE-2026-107698
orta		ffmpeg: ffmpeg: Server-Side Request Forgery via unvalidated RTSP redirects07:11 UTC derlemesi
CVE-2026-107697
orta		ffmpeg: ffmpeg: Security restriction bypass via crafted HLS master playlist07:11 UTC derlemesi
CVE-2026-107696
orta		ffmpeg: ffmpeg: Denial of Service via unlimited RTSP redirects07:11 UTC derlemesi
CVE-2026-107695
orta		ffmpeg: ffmpeg: Denial of Service via crafted HLS playlist07:11 UTC derlemesi
CVE-2026-107380
orta		enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision07:11 UTC derlemesi
CVE-2026-107379
orta		enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash07:11 UTC derlemesi
GHSA-w253-m66g-rx24
orta		Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection07:11 UTC derlemesi
GHSA-3wr7-993q-jrff
orta		Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules07:11 UTC derlemesi
GHSA-g4qm-m288-5cp9
orta		Coraza has Cookie Parser Confusion07:11 UTC derlemesi
GHSA-5gj4-9gm7-2fx2
orta		Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection07:11 UTC derlemesi
CVE-2026-88647
orta		gnutls: gnutls: Information disclosure via hostname verification bypass07:11 UTC derlemesi
CVE-2026-61801
orta		github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files07:11 UTC derlemesi
CVE-2026-107301
orta		msgpack5: Partial options disable prototype protection07:11 UTC derlemesi
CVE-2026-107299
orta		msgpack5: Reserved byte can cause unbounded stream buffering07:11 UTC derlemesi
CVE-2026-107298
orta		msgpack5: Deeply nested input can exhaust the decoder stack07:11 UTC derlemesi
CVE-2026-107297
orta		msgpack5: Quadratic parsing in the streaming decoder07:11 UTC derlemesi
CVE-2026-107294
orta		pydantic-ai: pydantic-ai: Denial of Service via unbounded HTTP response buffering07:11 UTC derlemesi
CVE-2026-107293
orta		pydantic-ai: pydantic-ai: Information disclosure via OpenTelemetry retry prompt logging07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.