Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated28 Oct 2026, 01:21 UTC

27critical, last 7 days 324high, last 7 days 661medium, last 7 days 104low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-101609 medium	mysql: mysql: Denial of service in InnoDB	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-101608 medium	mysql: mysql: Denial of Service via Server Optimizer component	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-101607 medium	mysql: mysql: Denial of Service in Server Optimizer	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-101516 medium	openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92388 medium	curl: curl: FTP wildcard write callback mixup	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113868 medium	thunderbird: Thunderbird: information disclosure via malformed authentication challenge	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113867 medium	thunderbird: thunderbird: Unauthorized actions via XMPP stanza injection	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113866 medium	thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113724 medium	virtualenv: virtualenv: Insecure file permission modification via symlink following	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113721 medium	virtualenv: virtualenv: Arbitrary file overwrite via insecure symlink handling	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113720 medium	virtualenv: virtualenv: Arbitrary code execution via insecure cached file permissions	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113719 medium	virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113718 medium	virtualenv: virtualenv: arbitrary code execution via improper quoting in xonsh activation scripts	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113717 medium	virtualenv: virtualenv: Integrity verification bypass via pip seeder download option	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113716 medium	virtualenv: virtualenv: Unauthorized file write via symlink following	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113715 medium	virtualenv: virtualenv: Environment isolation bypass via crafted destination path	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113714 medium	virtualenv: virtualenv: Unverified package installation via premature cache storage	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113713 medium	virtualenv: virtualenv: Arbitrary code execution via insecure temporary cache symlinks	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113712 medium	Cachet has Stored XSS in Incident Component	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113710 medium	ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113671 medium	ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113669 medium	ApostropheCMS: Cross-domain session token in URL confers session takeover	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113668 medium	ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113667 medium	ApostropheCMS: CAPTCHA response token not URL-encoded	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113664 medium	ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113662 medium	ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113661 medium	sanitize-html: sanitize-html: Cross-site scripting via unsafe meta refresh content attributes	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113660 medium	ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113659 medium	ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113656 medium	ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113655 medium	ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113654 medium	sanitize-html: sanitize-html: HTML sanitization bypass via improper noscript tag handling	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113653 medium	ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113652 medium	ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113650 medium	sanitize-html: sanitize-html: Denial of Service via unbounded recursion in iframe tag processing	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113649 medium	ApostropheCMS: Import API bypasses publication roles for protected content	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112958 medium	ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112957 medium	ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113602 medium	net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112956 medium	ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112955 medium	ApostropheCMS: Import archives can exhaust server storage and deny service	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112954 medium	ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112953 medium	ApostropheCMS: Exposure of Sensitive Information via predictable export filenames	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112952 medium	ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112951 medium	ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112950 medium	Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112949 medium	vitest: Vitest: Cross-site scripting via unescaped mock module URL	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112948 medium	vitest: vitest: Information disclosure via improper file access restrictions	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112947 medium	vite: vite: Information disclosure via crafted WebAssembly query parameter	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112945 medium	vite: vite: Arbitrary script execution via improper URL handling during HTML transformation	since at least 24 Oct 202607:11 UTC build	20 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.