Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
GHSA-4wwp-f6gw-6qm5
orta		SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)07:11 UTC derlemesi
GHSA-3cm4-ccvw-6xr6
orta		SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*07:11 UTC derlemesi
CVE-2026-63270
orta		libreoffice: LibreOffice: Information disclosure via crafted document URLs07:11 UTC derlemesi
CVE-2026-63269
orta		libreoffice: LibreOffice: Information disclosure via malicious HLS media playlists07:11 UTC derlemesi
CVE-2026-63268
orta		libreoffice: libreoffice: Information disclosure via external SQL data source links07:11 UTC derlemesi
CVE-2026-63267
orta		libreoffice: libreoffice: Information disclosure via automatic external CSV link loading07:11 UTC derlemesi
CVE-2026-63266
orta		libreoffice: LibreOffice: Arbitrary file write via embedded Firebird database links07:11 UTC derlemesi
CVE-2026-59788
orta		zabbix: Zabbix: Arbitrary script execution via unvalidated OAuth authorization endpoint URL07:11 UTC derlemesi
CVE-2026-59787
orta		zabbix: zabbix: Trap record injection via unsanitized delimiter in SNMP trap receiver07:11 UTC derlemesi
CVE-2026-59786
orta		zabbix: zabbix: Host status spoofing via unauthenticated active agent heartbeats07:11 UTC derlemesi
CVE-2026-59785
orta		zabbix: zabbix: Information disclosure via frontend host search filtering07:11 UTC derlemesi
CVE-2026-59783
orta		zabbix: Zabbix: Denial of service via null byte input in binary items07:11 UTC derlemesi
CVE-2026-59782
orta		zabbix: Zabbix: Information disclosure via the JavaScript preprocessing engine07:11 UTC derlemesi
CVE-2026-105306
orta		keycloak-services: keycloak-services: Token introspection audience bypass via Dynamic Client Registration07:11 UTC derlemesi
CVE-2026-105302
orta		keycloak-services: keycloak-services: User Session Note mapper exposes upstream IdP access tokens07:11 UTC derlemesi
CVE-2026-97873
orta		org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption07:11 UTC derlemesi
CVE-2026-71892
orta		org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: bouncycastle: Bouncy Castle: Key-size validation bypass via improper algorithm check07:11 UTC derlemesi
CVE-2026-71886
orta		bouncycastle: org.bouncycastle:bcpg-jdk18on: org.bouncycastle:bcpg-jdk15to18: bouncycastle: Unauthorized trust delegation via unverified subkey certification flags07:11 UTC derlemesi
CVE-2026-18040
orta		bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC07:11 UTC derlemesi
CVE-2026-105083
orta		ImageMagick: ImageMagick: Security policy bypass via alternate XML DOCTYPE declaration07:11 UTC derlemesi
CVE-2026-104477
orta		showdown: showdown: Cross-site scripting via unescaped double quotes in link and image attributes07:11 UTC derlemesi
GHSA-p23f-cm6q-2qp8
orta		SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)07:11 UTC derlemesi
GHSA-mwm8-39rw-8826
orta		Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array07:11 UTC derlemesi
GHSA-fj2x-mqqp-3v2w
orta		Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values07:11 UTC derlemesi
GHSA-4672-hwv6-gq62
orta		Trigger.dev: Cross-environment deployment cancel07:11 UTC derlemesi
GHSA-59h8-w5q6-mfmp
orta		Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId07:11 UTC derlemesi
GHSA-q567-cr4x-96w4
orta		Trigger.dev: Blind SSRF via alert-channel webhook07:11 UTC derlemesi
CVE-2026-104874
orta		multidict: multidict: Denial of Service via memory leak in items-view operations07:11 UTC derlemesi
CVE-2026-104872
orta		@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data07:11 UTC derlemesi
CVE-2026-104871
orta		Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows07:11 UTC derlemesi
CVE-2026-103918
orta		@orpc/zod: Prototype injection in smart coercion07:11 UTC derlemesi
GHSA-35mr-4567-66vg
orta		Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution07:11 UTC derlemesi
CVE-2026-104855
orta		wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations07:11 UTC derlemesi
CVE-2026-102795
orta		trafficserver: trafficserver: Security restriction bypass via improper access control07:11 UTC derlemesi
CVE-2026-104853
orta		nx: Nx: Arbitrary file write via path traversal in migration planning07:11 UTC derlemesi
CVE-2026-94544
orta		next: Next.js: Information disclosure via shared cache fills in Draft Mode07:11 UTC derlemesi
CVE-2026-94543
orta		next: Next.js: Response cache poisoning via improper route binding07:11 UTC derlemesi
CVE-2026-94486
orta		next: Next.js: Information disclosure via unrestricted cross-site requests07:11 UTC derlemesi
CVE-2026-94485
orta		next: Next.js: Information disclosure via unrestricted cross-site requests on development server07:11 UTC derlemesi
CVE-2026-94484
orta		next: Next.js: Denial of Service via response cache poisoning07:11 UTC derlemesi
CVE-2026-94483
orta		next: Next.js: Information disclosure via SSRF in Image Optimization07:11 UTC derlemesi
CVE-2026-104844
orta		postcss-selector-parser: postcss-selector-parser: Denial of Service via crafted CSS selectors07:11 UTC derlemesi
CVE-2026-103627
orta		chromium-browser: Information leak in SVG07:11 UTC derlemesi
GHSA-c9xm-49cp-xcr9
orta		rmcp OAuth client fetches server-controlled resource_metadata URLs07:11 UTC derlemesi
CVE-2026-104721
orta		ch.qos.logback/logback-classic: logback-classic: Arbitrary file write via path traversal in MDC discriminator07:11 UTC derlemesi
CVE-2026-83632
orta		thrift: Apache Thrift: Denial of Service via crafted HTTP requests07:11 UTC derlemesi
CVE-2026-66331
orta		thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport07:11 UTC derlemesi
CVE-2026-94652
orta		thrift: thrift: Denial of Service via memory leak in C++ bindings07:11 UTC derlemesi
CVE-2026-94638
orta		thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings07:11 UTC derlemesi
CVE-2026-92834
orta		thrift: Apache Thrift: C++ WebSocket server transport does not read a full request length07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.