Vulnerabilities
Critical vulnerabilities the gate already knows.
Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.
Database last updated27 Oct 2026, 13:12 UTC
23critical, last 7 days298high, last 7 days633medium, last 7 days139low, last 7 days| ID | Vulnerability | Severity source / ecosystems | Critical since | Published |
|---|---|---|---|---|
| CVE-2026-107282 critical | org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostasync-http-client, org.asynchttpclient:async-http-client, druid and 6 more | GHSA, Red HatGHSA 9.4chainguard, seal maven, debian, minimos, rapidfort debian +4 | 07:11 UTC build | |
| CVE-2026-62253 critical | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)github.com/sipcapture/homer-app | GHSAGHSA 9.8go | 07:11 UTC build | |
| CVE-2026-62252 critical | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Logingithub.com/sipcapture/homer-app | GHSAGHSA 9.8go | 07:11 UTC build | |
| CVE-2026-62176 critical | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generationpraisonai | GHSAGHSA 9.1pip | 07:11 UTC build | |
| CVE-2026-92414 critical | : Session Fixation / Session Reuse across Users vulnerability in Apach ...jackrabbit | NVDNVD 9.1debian, rapidfort debian, echo | 07:11 UTC build | |
| CVE-2026-105192 critical | LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportkserve-huggingfaceserver-cuda-13.3, lmcache, lmcache-cuda-13.0 | GHSAGHSA 9.8chainguard, pip | 07:11 UTC build | |
| CVE-2026-81535 critical | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel…wolfssh | NVDNVD 9.1alpine | 07:11 UTC build | |
| CVE-2026-106486 critical | plugin-scaffolder-backend-module-bitbucket-cloud: plugin-scaffolder-backend-module-bitbucket-server: Backstage: Unauthorized file manipulation via Bitbucket pull-request Scaffolder actions@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server | NVDNVD 9.9npm | 07:11 UTC build | |
| CVE-2026-95106 critical | Gitea review and execution mismatch through duplicate tree entriesgitea, gitea-fips | BitnamiBitnami 9.1rapidfort alpine, minimos, bitnami | 07:11 UTC build | |
| CVE-2026-73278 critical | Gitea WebAuthn bypass during OAuth and OIDC sign-ingitea, gitea-fips | BitnamiBitnami 9.8rapidfort alpine, minimos, alpine, bitnami | 07:11 UTC build | |
| CVE-2026-106237 critical | chromium-browser: Information leak in Permissionschromium, chromedriver, chromium-common and 3 more | NVDNVD 9.6rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | 07:11 UTC build | |
| CVE-2026-106195 critical | chromium-browser: Incorrect authorization in Chromotingchromium, chromedriver, chromium-common and 3 more | NVDNVD 9.1rapidfort Oracle Linux, rapidfort fedora, debian, rapidfort debian, chainguard +3 | 07:11 UTC build | |
| CVE-2026-106102 critical | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasar | GHSAGHSA 10.0npm | 07:11 UTC build | |
| CVE-2026-105863 critical | Payload authentication token field handling issuepayload | NVD, GHSANVD 9.4npm | 07:11 UTC build | |
| CVE-2026-105859 critical | Payload: Unauthorized update to collection documentspayload | GHSAGHSA 9.8npm | 07:11 UTC build | |
| CVE-2026-105857 critical | Payload Form Builder has an RCE issue@payloadcms/plugin-form-builder | GHSAGHSA 10.0npm | 07:11 UTC build | |
| CVE-2026-105848 critical | Payload: Insufficient Access Control in Stripe REST Proxy@payloadcms/plugin-stripe | NVDNVD 9.6npm | 07:11 UTC build | |
| CVE-2026-105845 critical | Payload: SQL Injection in SQLite and Postgrespayload | GHSAGHSA 9.8npm | 07:11 UTC build | |
| CVE-2026-105844 critical | Payload: Prototype pollution in Payload Import Export plugin@payloadcms/plugin-import-export | GHSAGHSA 9.3npm | 07:11 UTC build | |
| CVE-2026-105794 critical | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLMicrosoft.Native.Quic.MsQuic.OpenSSL, microsoft.native.quic.msquic.openssl | GHSAGHSA 9.1nuget | 07:11 UTC build | |
| CVE-2026-105697 critical | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationlangflow, langflow-base, lfx | GHSAGHSA 10.0pip | 07:11 UTC build | |
| GHSA-v2f8-6655-7grj critical | Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainvibe-trading-ai | GHSAGHSA 10.0pip | 07:11 UTC build | |
| GHSA-jqmf-mx4f-hfr6 critical | Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFvibe-trading-ai | GHSAGHSA 10.0pip | 07:11 UTC build | |
| GHSA-gg6r-gp4c-89hp critical | Trigger.dev: V1 coordinator default-secret unauth Socket.IOtrigger.dev | GHSAGHSA 9.2npm | 07:11 UTC build | |
| CVE-2026-103922 critical | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path@capacitor/android, @capacitor/ios, com.capacitorjs:core and 1 more | GHSAGHSA 9.3npm, maven, swift | 07:11 UTC build | |
| CVE-2026-101276 critical | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use- ...iperf3, iperf, iperf-doc | Photon OSPhoton OS, debian, rapidfort debian, alpine | 07:11 UTC build | |
| CVE-2026-55107 critical | kobako Sandbox Escape - guest eval reaches host RCE via method_missing → public_send (any bound Service)kobako | GHSA, Ruby Advisory DBGHSA 10.0rubygems | 07:11 UTC build | |
| GHSA-vcvr-r3jv-pc5j critical | Next.js: Remote Code Execution in next/og ImageResponsenext | GHSAGHSA 9.5echo npm, npm | 07:11 UTC build | |
| CVE-2026-102828 critical | simple-git: simple-git unsafe-operation guard does not block trailer command configurationgrafana, grafana-selinux, renovate and 5 more | NVD, GHSANVD 9.8rapidfort Oracle Linux, rapidfort Red Hat, rapidfort alma, rapidfort rocky, Red Hat +6 | 07:11 UTC build | |
| CVE-2026-102827 critical | simple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)renovate, simple-git, @seal-security/simple-git and 17 more | NVDNVD 9.8Red Hat, chainguard, minimos, seal npm, npm +1 | 07:11 UTC build | |
| CVE-2026-102560 critical | libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growthlibsoup3, libsoup, libsoup2.4 and 7 more | NVDNVD 9.8rapidfort ubuntu, ubuntu, rapidfort debian, debian, alma +10 | 07:11 UTC build | |
| CVE-2026-102676 critical | electron: electron: Privilege escalation via unauthorized Node.js integration in web workerselectron | NVDNVD 9.8npm | 07:11 UTC build | |
| CVE-2026-102268 critical | pyjwt: PyJWT: Authentication bypass via improper public key validationpyjwt, fence-agents-aliyun, fence-agents-all and 147 more | GHSA, Red Hat, Azure Linux, Photon OSGHSA 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +16 | 07:11 UTC build | |
| CVE-2026-102267 critical | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirectspyjwt, fence-agents-aliyun, fence-agents-all and 157 more | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, Red Hat, chainguard +16 | 07:11 UTC build | |
| CVE-2026-102266 critical | pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptancefence-agents-aliyun, fence-agents-all, fence-agents-aws and 142 more | NVD, Photon OSNVD 9.1rapidfort alma, rapidfort Oracle Linux, rapidfort Red Hat, chainguard, Red Hat +15 | 07:11 UTC build |
Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.