Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-104044
orta		sssd: sssd: Denial of Service via crafted passkey Kerberos authentication request07:11 UTC derlemesi
CVE-2026-104043
orta		sssd: sssd: Denial of Service via undersized packet parsing in NSS responder07:11 UTC derlemesi
CVE-2026-104042
orta		sssd: sssd: Denial of Service via out-of-bounds read in PAM responder07:11 UTC derlemesi
CVE-2026-104041
orta		sssd: sssd: Denial of Service via unbounded negative cache growth07:11 UTC derlemesi
CVE-2026-104040
orta		sssd: sssd: Information disclosure via OData injection in Entra ID lookups07:11 UTC derlemesi
CVE-2026-104039
orta		sssd: sssd: Denial of service via stale connection state reuse in PAM GSSAPI responder07:11 UTC derlemesi
CVE-2026-104037
orta		sssd: sssd: Denial of Service via packet length underflow in autofs responder07:11 UTC derlemesi
CVE-2026-104035
orta		sssd: sssd: Denial of Service via memory exhaustion in KCM responder07:11 UTC derlemesi
CVE-2026-104033
orta		sssd: sssd: Access control bypass via improper LDAP shadow expiration check07:11 UTC derlemesi
GHSA-r4xh-jqrq-34v2
orta		smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line07:11 UTC derlemesi
GHSA-2mjx-qc3c-rqvc
orta		Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries07:11 UTC derlemesi
GHSA-g7fw-3gjp-g5hf
orta		OpenClaw: Channel read actions could skip target allowlists07:11 UTC derlemesi
CVE-2026-105760
orta		vllm: vllm: Denial of Service via excessive resource consumption in GLMGA video backend07:11 UTC derlemesi
CVE-2026-105758
orta		vllm: vllm: Denial of Service via unbounded video frame parameters07:11 UTC derlemesi
CVE-2026-105757
orta		vllm: vllm: Denial of Service via unhandled structured-output errors07:11 UTC derlemesi
CVE-2026-105756
orta		vllm: vllm: Denial of Service via unvalidated cache salt in API requests07:11 UTC derlemesi
CVE-2026-105755
orta		vllm: vllm: Scoring result corruption via user-controlled request identifier07:11 UTC derlemesi
CVE-2026-105754
orta		vllm: vllm: Denial of Service via unvalidated multimodal parameters in scale-out endpoint07:11 UTC derlemesi
CVE-2026-105753
orta		vllm: vllm: Denial of Service via multimodal cache desynchronization07:11 UTC derlemesi
GHSA-6f2x-v7q7-m7m5
orta		hickory-resolver follows irrelevant CNAME records07:11 UTC derlemesi
GHSA-jggr-w7fw-pc2j
orta		fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values07:11 UTC derlemesi
CVE-2026-93321
orta		github.com/moby/buildkit: BuildKit: Denial of Service via crafted low-level builder definition07:11 UTC derlemesi
CVE-2026-93315
orta		github.com/moby/buildkit: BuildKit: Denial of Service via manipulated CA bundle during cleanup07:11 UTC derlemesi
CVE-2026-105749
orta		docling: docling: Denial of Service via unbounded table span attributes07:11 UTC derlemesi
CVE-2026-105747
orta		docling: docling: Denial of Service via excessive memory allocation in archive processing07:11 UTC derlemesi
CVE-2026-105746
orta		docling: docling: Information disclosure via unenforced remote service restrictions07:11 UTC derlemesi
CVE-2026-105743
orta		docling: docling: Server-Side Request Forgery via improper URL validation07:11 UTC derlemesi
CVE-2026-105742
orta		docling: docling: Information disclosure via cross-origin header leakage during remote image fetching07:11 UTC derlemesi
CVE-2026-93326
orta		github.com/moby/buildkit: BuildKit: Security policy bypass via crafted Git source definition07:11 UTC derlemesi
CVE-2026-105698
orta		Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints07:11 UTC derlemesi
CVE-2026-105447
orta		quay: quay: global read-only superuser can access build trigger write credentials07:11 UTC derlemesi
CVE-2026-71299
orta		maestro: maestro: REST API write endpoints registered without authentication middleware07:11 UTC derlemesi
CVE-2026-71298
orta		maestro: SQL identifier injection via properties.* search filter and orderBy field07:11 UTC derlemesi
CVE-2026-71297
orta		maestro: maestro: gRPC broker has no auth interceptor and client mTLS is optional07:11 UTC derlemesi
CVE-2026-105681
orta		Ghost: Authorization Bypass in Comments Feature07:11 UTC derlemesi
CVE-2026-105680
orta		Ghost: Authorization Issue Allowed Author Role to Delete any Post07:11 UTC derlemesi
CVE-2026-105678
orta		Ghost: Editors Could Promote Staff Users to Their Own Role07:11 UTC derlemesi
CVE-2026-105676
orta		Ghost: Path Traversal via Locale Setting07:11 UTC derlemesi
CVE-2026-105648
orta		Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses07:11 UTC derlemesi
CVE-2026-105647
orta		Ghost: Server-Side Request Forgery in Bookmark Fetching07:11 UTC derlemesi
CVE-2026-105646
orta		Ghost: Regular Expression Denial of Service in Content Import07:11 UTC derlemesi
CVE-2026-105645
orta		Ghost: Regular Expression Denial of Service in External Media Inliner07:11 UTC derlemesi
CVE-2026-105644
orta		Ghost : Stored XSS via SVG Files in Content Imports07:11 UTC derlemesi
CVE-2026-93323
orta		github.com/moby/buildkit: BuildKit: Denial of Service via oversized build context files07:11 UTC derlemesi
CVE-2026-93322
orta		github.com/moby/buildkit: BuildKit: Denial of Service via crafted LLB definition07:11 UTC derlemesi
CVE-2026-93319
orta		github.com/moby/buildkit: buildkit: Denial of Service via data race triggered by external frontend07:11 UTC derlemesi
CVE-2026-93317
orta		github.com/moby/buildkit: BuildKit: Build integrity compromise via unvalidated blob digest caching07:11 UTC derlemesi
CVE-2026-93316
orta		github.com/moby/buildkit: BuildKit: Denial of Service via CDI device requests when CDI is disabled07:11 UTC derlemesi
CVE-2026-102576
orta		quay: quay: DOM-based cross-site scripting via unvalidated redirect_url on signin page07:11 UTC derlemesi
CVE-2026-102295
orta		quay: quay: DOM-based cross-site scripting via OAuth local callback format=json parameter07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.