Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme28 Eki 2026, 01:21 UTC
27kritik, son 7 gün324yüksek, son 7 gün661orta, son 7 gün104düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-105267
orta		code.gitea.io/gitea: Gitea: Unauthorized release deletion via tag deletion endpoint07:11 UTC derlemesi
CVE-2026-104633
orta		code.gitea.io/gitea: Gitea: Denial of Service via unbounded pagination loop during repository migration07:11 UTC derlemesi
CVE-2026-101023
orta		code.gitea.io/gitea: Gitea: Prolonged access via improper OAuth2 token type validation07:11 UTC derlemesi
CVE-2026-19029
orta		hdf5: HDF5: Denial of Service via crafted file in scale-offset filter07:11 UTC derlemesi
CVE-2026-106586
orta		openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding07:11 UTC derlemesi
CVE-2026-106585
orta		openssh: openssh: Denial of service via oversized decompressed packets07:11 UTC derlemesi
CVE-2026-106552
orta		openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy07:11 UTC derlemesi
CVE-2026-106494
orta		@backstage/backend-defaults: @backstage/backend-defaults: Content injection via crafted cloud storage object names07:11 UTC derlemesi
CVE-2026-106493
orta		backstage: Backstage: Information disclosure via improper object path validation in cloud storage catalog providers07:11 UTC derlemesi
CVE-2026-106492
orta		@backstage/backend-defaults: @backstage/backend-defaults: Access control bypass via improper service credential delegation07:11 UTC derlemesi
CVE-2026-106491
orta		plugin-proxy-backend: plugin-proxy-backend: Request forwarding outside configured base path via crafted URL07:11 UTC derlemesi
CVE-2026-106490
orta		Backstage: Improper input validation in TechDocs static content requests07:11 UTC derlemesi
CVE-2026-106489
orta		@backstage/plugin-techdocs-backend: Backstage: Information disclosure via improper authorization in TechDocs backend07:11 UTC derlemesi
CVE-2026-106487
orta		plugin-kubernetes-backend: plugin-kubernetes-backend: Information disclosure via catalog cluster authentication handling07:11 UTC derlemesi
CVE-2026-106463
orta		@backstage/plugin-catalog-backend-module-gitlab: Backstage plugin-catalog-backend-module-gitlab: Unauthorized access via improper GitLab user ingestion07:11 UTC derlemesi
CVE-2026-106462
orta		backstage: Backstage: Privilege escalation via improper credential boundary enforcement07:11 UTC derlemesi
CVE-2026-106461
orta		plugin-scaffolder-backend: plugin-scaffolder-backend: Information disclosure via incorrect authorization in task listing07:11 UTC derlemesi
CVE-2026-106460
orta		@backstage/plugin-auth-node: @backstage/plugin-auth-node: Privilege escalation via improper email verification07:11 UTC derlemesi
CVE-2026-106458
orta		Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates07:11 UTC derlemesi
CVE-2026-106456
orta		plugin-proxy-backend: plugin-proxy-backend: Authentication bypass via overlapping proxy routes07:11 UTC derlemesi
CVE-2026-106455
orta		@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node: Information disclosure via improper MkDocs configuration validation07:11 UTC derlemesi
CVE-2026-104045
orta		sssd: sssd: Denial of Service via race condition in autofs responder07:11 UTC derlemesi
CVE-2026-96589
orta		Gitea private repository access retained after rejected transfer07:11 UTC derlemesi
CVE-2026-96400
orta		Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS07:11 UTC derlemesi
CVE-2026-95112
orta		Gitea issue reference parsing CPU exhaustion07:11 UTC derlemesi
CVE-2026-94114
orta		org.apache.bcel/bcel: Apache Commons BCEL: Security verification bypass via unvalidated class caching07:11 UTC derlemesi
CVE-2026-76061
orta		cri-o: CRI-O: bind_mount_prefix intermediate-symlink prefix bypass07:11 UTC derlemesi
CVE-2026-106454
orta		twisted: Twisted: Denial of Service via regular expression backtracking in IMAP search patterns07:11 UTC derlemesi
CVE-2026-106453
orta		org.lz4/lz4-java: lz4-java: Denial of Service via untrusted decompressed length header07:11 UTC derlemesi
CVE-2026-106452
orta		org.lz4/lz4-java: lz4-java: Denial of Service via excessive memory allocation07:11 UTC derlemesi
CVE-2026-106451
orta		org.lz4/lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling07:11 UTC derlemesi
CVE-2026-106450
orta		org.lz4/lz4-java: lz4-java: Denial of Service via excessive memory allocation from crafted compressed streams07:11 UTC derlemesi
CVE-2026-106444
orta		handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates07:11 UTC derlemesi
CVE-2026-105111
orta		org.apache.bcel/bcel: Apache Commons BCEL: Stored Cross-Site Scripting via untrusted class files in Class2HTML07:11 UTC derlemesi
CVE-2026-103667
orta		Gitea container registry stored XSS through blob media type07:11 UTC derlemesi
CVE-2026-103008
orta		elasticsearch: elasticsearch: Denial of Service via uncontrolled recursion in scripted runtime fields07:11 UTC derlemesi
CVE-2026-103006
orta		elasticsearch: Elasticsearch: Denial of Service via deeply nested search aggregations07:11 UTC derlemesi
CVE-2026-103005
orta		elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation in connector descriptions07:11 UTC derlemesi
CVE-2026-102412
orta		Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure07:11 UTC derlemesi
CVE-2026-102411
orta		elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation during index template retrieval07:11 UTC derlemesi
CVE-2026-102410
orta		Missing Authorization in Kibana Leading to Information Disclosure07:11 UTC derlemesi
CVE-2026-102409
orta		elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion07:11 UTC derlemesi
CVE-2026-102408
orta		elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function07:11 UTC derlemesi
CVE-2026-102407
orta		elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API07:11 UTC derlemesi
CVE-2026-102404
orta		elasticsearch: Elasticsearch: Denial of Service via uncontrolled memory consumption from crafted queries07:11 UTC derlemesi
CVE-2026-101029
orta		Gitea migration and pull mirror SSRF through multi-answer DNS07:11 UTC derlemesi
CVE-2026-83550
orta		postgres-exporter: net/http/pprof exposed on metrics listener07:11 UTC derlemesi
CVE-2026-106425
orta		chromium-browser: Missing authorization in BrowserTag07:11 UTC derlemesi
CVE-2026-106424
orta		chromium-browser: Information leak in Audio07:11 UTC derlemesi
CVE-2026-106420
orta		chromium-browser: Incorrect calculation in API07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.