Zafiyetler

Gate'in zaten bildiği kritik zafiyetler.

Attestkeep her altı saatte bir Trivy vulnerability database'ini çeker; tarayıcı cluster'ınızın içinde aynı database'i okur. Bunlar database'in bu hafta kritik saydığı kayıtlar ve ne zaman saydığı. Haberin çıktığı an değil, gate'in öğrendiği an.

IDZafiyetBu seviyede olduğu tarihYayın
CVE-2026-100799
orta
firefox: Uninitialized memory in the Graphics: WebGPU component07:11 UTC derlemesi
CVE-2026-100798
orta
firefox: Cryptography misuse in Storage: Quota Manager component07:11 UTC derlemesi
CVE-2026-100797
orta
firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component07:11 UTC derlemesi
CVE-2026-100796
orta
Use-after-free in the JavaScript: WebAssembly component. This vul ...07:11 UTC derlemesi
CVE-2026-100795
orta
firefox: Denial-of-service in the Networking component07:11 UTC derlemesi
CVE-2026-100794
orta
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component07:11 UTC derlemesi
CVE-2026-100765
orta
Use-after-free in the JavaScript: WebAssembly component. This vulnerab ...07:11 UTC derlemesi
CVE-2026-100764
orta
Privilege escalation due to incorrect boundary conditions in the ...07:11 UTC derlemesi
CVE-2026-96422
orta
wireshark: Reachable Assertion in Wireshark07:11 UTC derlemesi
CVE-2026-96421
orta
wireshark: Wireshark: Denial of Service via USB HID dissector infinite loop07:11 UTC derlemesi
CVE-2026-96420
orta
wireshark: Buffer Over-read in Wireshark07:11 UTC derlemesi
CVE-2026-96418
orta
wireshark: Wireshark: Denial of Service via infinite loop in TIFF protocol dissector07:11 UTC derlemesi
CVE-2026-96417
orta
wireshark: wireshark: Denial of Service via malformed RF4CE packet07:11 UTC derlemesi
CVE-2026-96416
orta
wireshark: Wireshark: Denial of Service via malformed IEEE 802.11 packet processing07:11 UTC derlemesi
CVE-2026-96415
orta
wireshark: Stack-based Buffer Overflow in Wireshark07:11 UTC derlemesi
CVE-2026-95395
orta
wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector07:11 UTC derlemesi
CVE-2026-95393
orta
wireshark: Heap-based Buffer Overflow in Wireshark07:11 UTC derlemesi
CVE-2026-95392
orta
wireshark: Buffer Over-read in Wireshark07:11 UTC derlemesi
CVE-2026-95391
orta
wireshark: Use After Free in Wireshark07:11 UTC derlemesi
CVE-2026-95390
orta
wireshark: Wireshark: Denial of Service via crafted PEAK CAN TRC file07:11 UTC derlemesi
CVE-2026-95388
orta
wireshark: wireshark: Denial of Service via heap-based buffer overflow in sharkd07:11 UTC derlemesi
CVE-2026-95386
orta
wireshark: wireshark: Denial of Service via infinite loop in TTL file parser07:11 UTC derlemesi
CVE-2026-8937
orta
Missing Authorization in GitLab07:11 UTC derlemesi
CVE-2026-15390
orta
Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP reassemb ...07:11 UTC derlemesi
CVE-2026-10518
orta
Incorrect Authorization in GitLab07:11 UTC derlemesi
CVE-2026-102474
orta
dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation07:11 UTC derlemesi
CVE-2026-102473
orta
dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled07:11 UTC derlemesi
CVE-2026-97029
orta
flatpak: flatpak: Sandboxed app can signal unsandboxed processes in the same process group07:11 UTC derlemesi
CVE-2026-102414
orta
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...07:11 UTC derlemesi
GHSA-6vj9-mwq6-2f5v
orta
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure07:11 UTC derlemesi
CVE-2026-102277
orta
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns07:11 UTC derlemesi
CVE-2026-102270
orta
pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format07:11 UTC derlemesi
CVE-2026-102269
orta
pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding07:11 UTC derlemesi
CVE-2026-102265
orta
pyjwt: pyjwt: Denial of Service via deeply nested token headers07:11 UTC derlemesi
CVE-2026-101914
orta
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches07:11 UTC derlemesi
CVE-2026-102010
orta
gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if07:11 UTC derlemesi
CVE-2026-55156
orta
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints07:11 UTC derlemesi
CVE-2026-101913
orta
ip-address: ip-address: Security bypass via incomplete IPv6 link-local address validation07:11 UTC derlemesi
CVE-2026-101912
orta
ip-address: ip-address: Access control bypass via cross-family subnet comparison07:11 UTC derlemesi
CVE-2026-101911
orta
ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing07:11 UTC derlemesi
CVE-2026-101910
orta
ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range07:11 UTC derlemesi
CVE-2026-101908
orta
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution07:11 UTC derlemesi
CVE-2026-101907
orta
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter07:11 UTC derlemesi
CVE-2026-101904
orta
axios: Axios: HTTP header injection via inherited prototype properties07:11 UTC derlemesi
CVE-2026-101902
orta
axios: axios: Unintended HTTP method override via prototype pollution gadget07:11 UTC derlemesi
CVE-2026-101900
orta
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter07:11 UTC derlemesi
CVE-2026-101898
orta
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings07:11 UTC derlemesi
CVE-2026-101101
orta
ag-ui: ag-ui: Denial of Service via uncaught JSON parsing exception07:11 UTC derlemesi
CVE-2026-101100
orta
@ag-ui/client: ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup07:11 UTC derlemesi
CVE-2026-88816
orta
perl-DBI: perl-DBI: Denial of Service via numeric FetchHashKeyName attribute07:11 UTC derlemesi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.