Attestkeep
Dil: Türkçe
Kayıt ol
Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

Database son güncelleme27 Eki 2026, 19:17 UTC
29kritik, son 7 gün411yüksek, son 7 gün649orta, son 7 gün145düşük, son 7 gün
IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-86536
orta		thrift: thrift: Prototype pollution in JavaScript bindings07:11 UTC derlemesi
CVE-2026-104417
orta		Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting07:11 UTC derlemesi
CVE-2026-104412
orta		Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment07:11 UTC derlemesi
CVE-2026-97876
orta		grub2: grub2: Secure Boot lockdown bypass via improper serial address validation07:11 UTC derlemesi
CVE-2026-85483
orta		thrift: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end07:11 UTC derlemesi
CVE-2026-95512
orta		freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader07:11 UTC derlemesi
CVE-2026-86345
orta		389-ds-base: 389-ds-base: StartTLS plaintext-buffer retention allows on-path attacker to forge an LDAP client's authentication result07:11 UTC derlemesi
CVE-2026-104183
orta		stream-json: stream-json: Object prototype manipulation via crafted JSON input07:11 UTC derlemesi
CVE-2026-104182
orta		stream-json: stream-json: Denial of Service via inefficient comment scanning07:11 UTC derlemesi
CVE-2026-104181
orta		Filament: Multi-factor authentication (app) management actions do not require password reauthentication07:11 UTC derlemesi
CVE-2026-55252
orta		OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect07:11 UTC derlemesi
CVE-2026-104056
orta		authlib: authlib: Information disclosure via unvalidated discovery metadata07:11 UTC derlemesi
CVE-2026-56098
orta		rubygem-katello: improper authorization logic allows resource enumeration07:11 UTC derlemesi
CVE-2026-56097
orta		rubygem-katello: SQL injection in Registry Proxy via labels07:11 UTC derlemesi
CVE-2026-12545
orta		rubygem-hammer_cli: command injection via insecure editor invocation07:11 UTC derlemesi
CVE-2026-103923
orta		katex: katex: Cross-site scripting via prototype pollution inheritance07:11 UTC derlemesi
CVE-2026-103884
orta		A flaw was found in the X.509 client certificate authenticator of Keycloak.07:11 UTC derlemesi
CVE-2026-93546
orta		httpd: httpd: Denial of Service via integer overflow in mod_dav_fs07:11 UTC derlemesi
CVE-2026-79768
orta		httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence07:11 UTC derlemesi
CVE-2026-77387
orta		geopy: geopy: Denial of Service via inefficient regular expression coordinate parsing07:11 UTC derlemesi
CVE-2026-73637
orta		httpd: httpd: Authentication state corruption via concurrent Digest authentication requests07:11 UTC derlemesi
CVE-2026-63045
orta		httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response07:11 UTC derlemesi
CVE-2026-59797
orta		httpd: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function07:11 UTC derlemesi
CVE-2026-58415
orta		httpd: httpd: Information disclosure via direct request to the WebDAV state directory07:11 UTC derlemesi
CVE-2026-57941
orta		httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy07:11 UTC derlemesi
CVE-2026-42528
orta		httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error07:11 UTC derlemesi
CVE-2026-103505
orta		github.com/kubernetes-sigs/aws-efs-csi-driver: AWS EFS CSI Driver: Arbitrary mount option injection via mounttargetipmap attribute07:11 UTC derlemesi
GHSA-hx4r-w6wj-j8fg
orta		devalue: Residual sparse-array CPU amplification in uneval07:11 UTC derlemesi
CVE-2026-103004
orta		next: Next.js: Information disclosure via cache key omission in nested cache handlers07:11 UTC derlemesi
GHSA-4q55-j62x-fr9h
orta		devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion07:11 UTC derlemesi
CVE-2026-94276
orta		Apache APISIX: Openid-connect introspection validation issue07:11 UTC derlemesi
CVE-2026-94269
orta		Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch07:11 UTC derlemesi
CVE-2026-94212
orta		Apache APISIX: unauthenticated impersonation issue in saml-auth07:11 UTC derlemesi
CVE-2026-103754
orta		ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory07:11 UTC derlemesi
CVE-2026-103680
orta		A flaw was found in tnef. A heap-based buffer overflow can occur in th ...07:11 UTC derlemesi
CVE-2026-82806
orta		Apache APISIX: cross-request permission pollution via static permission list mutation07:11 UTC derlemesi
CVE-2026-78242
orta		Apache APISIX: data-mask may fail to redact request headers in logger output07:11 UTC derlemesi
CVE-2026-103291
orta		Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch07:11 UTC derlemesi
CVE-2026-103290
orta		Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize07:11 UTC derlemesi
CVE-2026-103287
orta		Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook07:11 UTC derlemesi
CVE-2026-103285
orta		Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery07:11 UTC derlemesi
CVE-2026-103284
orta		Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback07:11 UTC derlemesi
CVE-2026-103282
orta		Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token07:11 UTC derlemesi
CVE-2026-103281
orta		Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API07:11 UTC derlemesi
CVE-2026-103280
orta		Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint07:11 UTC derlemesi
CVE-2026-103276
orta		Ghost before 6.20.0 File Read via URL Encoding Bypass07:11 UTC derlemesi
CVE-2026-103275
orta		Ghost 5.42.2 before 6.58.0 Password Hash Disclosure07:11 UTC derlemesi
CVE-2026-103274
orta		Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read07:11 UTC derlemesi
CVE-2026-103273
orta		Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token07:11 UTC derlemesi
CVE-2026-103269
orta		Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.