Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-106298 high	chromium-browser: Use after free in Chrome Tabs	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106293 high	chromium-browser: angle: Type confusion in ANGLE	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106281 high	chromium-browser: Use after free in Tint	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106278 high	chromium-browser: Use after free in Select	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106273 high	chromium-browser: Uninitialized resource in Video	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106268 high	chromium-browser: Use after free in WebRTC	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106258 high	chromium-browser: angle: Uninitialized resource in ANGLE	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106257 high	chromium-browser: Use after free in HTML	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106255 high	chromium-browser: Race condition in V8	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106248 high	chromium-browser: Use after free in Bindings	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106245 high	chromium-browser: angle: Uninitialized resource in ANGLE	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106243 high	chromium-browser: Incomplete cleanup in Proxy Auth	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106240 high	chromium-browser: Type confusion in V8	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106239 high	chromium-browser: Integer overflow in WebGL	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106235 high	chromium-browser: Use after free in WebAudio	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106233 high	chromium-browser: Use after free in Metrics	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106231 high	chromium-browser: Uninitialized resource in Dawn	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106227 high	chromium-browser: Use after free in Core	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106221 high	chromium-browser: Confused deputy in WebAPKs	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106215 high	chromium-browser: angle: Uninitialized resource in ANGLE	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106214 high	chromium-browser: Information leak in Proxy	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106211 high	chromium-browser: Use after free in TabStrip	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106204 high	chromium-browser: Use after free in PDF	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106203 high	chromium-browser: Incomplete cleanup in Autofill	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106202 high	chromium-browser: angle: Uninitialized resource in ANGLE	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106200 high	chromium-browser: Use after free in Track	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106199 high	chromium-browser: Incorrect authorization in Actor	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106198 high	chromium-browser: Missing authorization in FileSystem	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106197 high	chromium-browser: Use after free in Browser	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106196 high	chromium-browser: Missing authorization in Navigation	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106193 high	chromium-browser: Use after free in Parser	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106190 high	chromium-browser: Use after free in Media	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106188 high	chromium-browser: Confused deputy in SignIn	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106184 high	chromium-browser: Uninitialized resource in Media	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106122 high	The RabbitMQ Java client library allows Java and JVM-based application ...	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106121 high	The RabbitMQ Java client library allows Java and JVM-based application ...	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106118 high	ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-102322 high	chromium-browser: Incorrect Authorization in SiteIsolation	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106117 high	ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106115 high	ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106113 high	ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106112 high	ImageSharp: ICC LUT16 output channel count can write beyond Vector4	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106110 high	ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106107 high	Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106106 high	Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106105 high	Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106104 high	Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106103 high	Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-106100 high	Payload: Field-level write access bypass in Payload on MongoDB	since at least 24 Oct 202607:11 UTC build	6 Oct 2026
CVE-2026-105868 high	Payload: Uploaded XML files could execute same-origin JavaScript	since at least 24 Oct 202607:11 UTC build	6 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.