Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated28 Oct 2026, 01:21 UTC

27critical, last 7 days 324high, last 7 days 661medium, last 7 days 104low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-79608 medium	xen: xen: Information disclosure via inverted conditional in Zenbleed workaround	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-54700 medium	ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-54697 medium	ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-49265 medium	oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-49264 medium	oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-102832 medium	jupyterlab: JupyterLab: Improper trust assignment via active document switching	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-102699 medium	xen: xen: Denial of Service via integer underflow during cache flushing	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-102672 medium	Electron: Local race condition in Squirrel.Mac update installation on macOS	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-101899 medium	axios: Axios: Information disclosure via improper CIDR proxy bypass handling	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-77375 medium	SFTPGo: Denial of service via malformed SSH channel request	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-106108 medium	Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-103028 medium	SFTPGo source-side file-pattern filter bypass during copy operations	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-102603 medium	Gotify: Insufficiently Protected Password Change endpoint	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-102342 medium	ammonia: ammonia: Stored cross-site scripting via SVG animation elements	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-77362 medium	obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-77361 medium	obsidian-tc : Symlink read-ACL scope bypass via lexical path checks	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109964 medium	ImageMagick: ImageMagick: Arbitrary code execution via crafted PICT image	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109956 medium	nltk: nltk: Arbitrary file write via path traversal in WekaClassifier	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109955 medium	hono: hono: Security bypass via double path decoding	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109953 medium	FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected crede ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109952 medium	The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selecte ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109951 medium	FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerab ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109950 medium	FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vu ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109949 medium	freerdp: FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109948 medium	freerdp: FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109947 medium	FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource al ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109946 medium	FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109945 medium	FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerabili ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109944 medium	freerdp: FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109943 medium	freerdp: FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109942 medium	freerdp: FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109941 medium	FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerabili ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109940 medium	freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109939 medium	freerdp: FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109938 medium	freerdp: FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109680 medium	freerdp: FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109679 medium	FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109678 medium	freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109677 medium	freerdp: FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109676 medium	FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulne ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109833 medium	gnome-remote-desktop: Heap buffer overflow in gnome-remote-desktop VNC TLS peek buffer handling allows remote denial of service	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109783 medium	Mitigation bypass in the File Handling component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109782 medium	Mitigation bypass in the File Handling component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109781 medium	Denial-of-service in the Printing: Output component. This vulnerabilit ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109780 medium	Mitigation bypass in the DOM: Core & HTML component. This vulnera ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109779 medium	Race condition in the Networking: DNS component. This vulnerabili ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109778 medium	Privilege escalation in the WebExtensions component. This vulnerabilit ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109777 medium	Information disclosure in the Storage: IndexedDB component. This vulne ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109776 medium	Race condition in the XPCOM component. This vulnerability was fixed in ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109775 medium	Denial-of-service in the WebRTC component. This vulnerability was fixe ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.