Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-107292
orta
pydantic-ai: pydantic-ai: Unauthorized tool execution via DNS rebinding07:11 UTC derlemesi
CVE-2026-107291
orta
pydantic-ai: pydantic-ai-slim: Pydantic AI: Information disclosure via incomplete telemetry content redaction07:11 UTC derlemesi
CVE-2026-107290
orta
pydantic-ai: pydantic-ai: Denial of Service via inefficient web response parsing07:11 UTC derlemesi
CVE-2026-19585
orta
github.com/hashicorp/go-getter: go-getter: arbitrary file write via path traversal in S3 and GCS directory downloads07:11 UTC derlemesi
CVE-2026-107678
orta
ffmpeg: ffmpeg: Denial of Service via stack exhaustion from crafted MP4 files07:11 UTC derlemesi
CVE-2026-107677
orta
ffmpeg: ffmpeg: Denial of Service via empty SegmentTemplate in DASH demuxer07:11 UTC derlemesi
CVE-2026-107675
orta
ffmpeg: ffmpeg: Information disclosure via missing SFTP host key verification07:11 UTC derlemesi
CVE-2026-107660
orta
ffmpeg: ffmpeg: Traffic interception via improper TLS certificate validation07:11 UTC derlemesi
CVE-2026-107287
orta
pydantic-ai: pydantic-ai: Denial of Service via resource exhaustion during HTML conversion07:11 UTC derlemesi
CVE-2026-107623
orta
keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation07:11 UTC derlemesi
CVE-2026-107604
orta
keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints07:11 UTC derlemesi
CVE-2026-107565
orta
luksmeta: Incomplete gap-boundary and overlap checks in LUKS1 metadata allocator allow data corruption07:11 UTC derlemesi
CVE-2026-105828
orta
Parse Server 9.0.0 before 9.10.1 Class Name Disclosure via GraphQL Errors07:11 UTC derlemesi
CVE-2026-103663
orta
Ollama: Path Traversal leading to Remote Code Execution in Ollama07:11 UTC derlemesi
CVE-2026-44038
orta
dcmtk: dcmtk: Denial of Service via out-of-bounds read in JPEG decoder07:11 UTC derlemesi
CVE-2026-44037
orta
dcmtk: dcmtk: Denial of Service via deeply nested DICOM JSON document07:11 UTC derlemesi
CVE-2026-44036
orta
dcmtk: dcmtk: Denial of Service via uncontrolled recursion during XML parsing07:11 UTC derlemesi
CVE-2026-44035
orta
dcmtk: dcmtk: Denial of Service via uncontrolled recursion in DICOMDIR processing07:11 UTC derlemesi
CVE-2026-44034
orta
dcmtk: dcmtk: Information disclosure via crafted RLE DICOM file07:11 UTC derlemesi
CVE-2026-44033
orta
dcmtk: dcmtk: Denial of Service via deeply nested XML elements07:11 UTC derlemesi
CVE-2026-107466
orta
flatpak-builder: Local File Exfiltration via `file07:11 UTC derlemesi
CVE-2026-107445
orta
rubygem-katello: katello: katello: Katello Flatpak Remote Repositories API cross-organization authorization bypass07:11 UTC derlemesi
CVE-2026-107444
orta
rubygem-katello: katello: katello: Katello Docker Tags repositories API cross-organization authorization bypass07:11 UTC derlemesi
CVE-2026-107315
orta
org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via residual send buffer padding07:11 UTC derlemesi
CVE-2026-107314
orta
org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via requireAuth restriction bypass07:11 UTC derlemesi
CVE-2026-107285
orta
The AsyncHttpClient (AHC) library allows Java applications to easily e ...07:11 UTC derlemesi
CVE-2026-107280
orta
The AsyncHttpClient (AHC) library allows Java applications to easily e ...07:11 UTC derlemesi
CVE-2026-105820
orta
vault: Vault: Privilege escalation via path traversal in ACL policy cache07:11 UTC derlemesi
CVE-2026-105818
orta
Vault PKI ACME Issues Certificate With Unvalidated SANs07:11 UTC derlemesi
CVE-2026-1403
orta
Allocation of Resources Without Limits or Throttling in GitLab07:11 UTC derlemesi
CVE-2026-107228
orta
The AsyncHttpClient (AHC) library allows Java applications to easily e ...07:11 UTC derlemesi
CVE-2026-107176
orta
cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret07:11 UTC derlemesi
CVE-2026-107161
orta
cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients07:11 UTC derlemesi
CVE-2026-107313
orta
org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via stale GSS buffer reuse07:11 UTC derlemesi
CVE-2026-107225
orta
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml07:11 UTC derlemesi
CVE-2026-107224
orta
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader07:11 UTC derlemesi
CVE-2026-107222
orta
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check07:11 UTC derlemesi
CVE-2026-107221
orta
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API07:11 UTC derlemesi
CVE-2026-107220
orta
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref07:11 UTC derlemesi
CVE-2026-107218
orta
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics07:11 UTC derlemesi
CVE-2026-107213
orta
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element07:11 UTC derlemesi
CVE-2026-107211
orta
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic07:11 UTC derlemesi
CVE-2026-106067
orta
GIMP: GIMP: heap buffer overflow in Hot color filter on oversized image07:11 UTC derlemesi
CVE-2026-106066
orta
GIMP: GIMP: heap buffer overflow in raw data export on oversized image dimensions07:11 UTC derlemesi
CVE-2026-106065
orta
GIMP: GIMP: heap buffer overflow in PCX export on oversized image dimensions07:11 UTC derlemesi
CVE-2026-92415
orta
\u2014 Use of Externally-Controlled Input to Select Classes or Code vu ...07:11 UTC derlemesi
CVE-2026-107210
orta
ImageMagick: ImageMagick: Resource exhaustion via crafted MAT image07:11 UTC derlemesi
CVE-2026-107208
orta
ImageMagick: ImageMagick: Denial of Service via crafted XMP profile07:11 UTC derlemesi
CVE-2026-106577
orta
ImageMagick: ImageMagick: Code injection via unescaped values in PostScript coders07:11 UTC derlemesi
CVE-2026-106575
orta
ImageMagick: ImageMagick: Denial of Service via unclosed file pointers in Magick scripts07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.