Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated28 Oct 2026, 01:21 UTC

27critical, last 7 days 324high, last 7 days 661medium, last 7 days 104low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-109774 medium	Invalid pointer, undefined behavior in the DOM: Notifications com ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109773 medium	Denial-of-service in the Sync component. This vulnerability was f ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109772 medium	Same-origin policy bypass in the DevTools component. This vulnera ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109771 medium	Information disclosure in the WebRTC: Networking component. This ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109770 medium	Spoofing issue in the DOM: Web Serial component. This vulnerability wa ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109769 medium	Information disclosure in the Networking: Cache component. This v ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109768 medium	Denial-of-service in the Site Reports component. This vulnerabili ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109767 medium	Information disclosure in the Networking component. This vulnerability ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109766 medium	Mitigation bypass in the Enterprise Policies component. This vulnerabi ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109765 medium	firefox: Race condition, use-after-free in the Graphics: Text component	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109764 medium	Mitigation bypass in the Enterprise Policies component. This vulnerabi ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109763 medium	Mitigation bypass in the File Handling component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109762 medium	Incorrect boundary conditions in the SVG component. This vulnerability ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109761 medium	Use-after-free in the JavaScript: WebAssembly component. This vul ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109760 medium	Mitigation bypass in the Networking: HTTP component. This vulnerabilit ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109759 medium	Site isolation issue in the Networking component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109757 medium	Sandbox escape due to race condition in the Networking component. This ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109756 medium	Privilege escalation in the DOM: Navigation component. This vulnerabil ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109755 medium	Sandbox escape in the DOM: Content Processes component. This vuln ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109754 medium	Incorrect boundary conditions in the DOM: Editor component. This vulne ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109753 medium	Incorrect boundary conditions in the Layout component. This vulnerabil ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109752 medium	Use-after-free in the DOM: Workers component. This vulnerability was f ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109751 medium	Information disclosure in the Networking component. This vulnerability ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109750 medium	Site isolation issue in the DOM: Web Authentication component. Th ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109749 medium	Use-after-free in the JavaScript: WebAssembly component. This vul ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109748 medium	Use-after-free in the JavaScript: WebAssembly component. This vul ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109747 medium	Other issue in the Address Bar component. This vulnerability was ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109746 medium	Mitigation bypass in the DOM: Security component. This vulnerabil ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109745 medium	Sandbox escape due to uninitialized memory in the DOM: Web Serial comp ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109744 medium	Other issue in the DOM: File component. This vulnerability was fixed i ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109743 medium	Privilege escalation in the Panning and Zooming component. This vulner ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109742 medium	Information disclosure in the PDF Viewer component. This vulnerability ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109741 medium	firefox: Use-after-free in the Storage: Bucket File System component	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109739 medium	Privilege escalation in the WebExtensions component. This vulnera ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109738 medium	Use-after-free in the Audio/Video: Playback component. This vulnerabil ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109737 medium	Mitigation bypass in the Enterprise Policies component. This vulnerabi ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109736 medium	Frame poisoning in the Layout component. This vulnerability was fixed ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109735 medium	Use-after-free in the DOM: Animation component. This vulnerabilit ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109734 medium	Mitigation bypass in the DOM: Security component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109733 medium	JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109731 medium	Incorrect boundary conditions in the Graphics: Canvas2D component. Thi ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109730 medium	Integer overflow in the Graphics component. This vulnerability was fix ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109728 medium	Use-after-free in the DOM: Animation component. This vulnerability was ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109725 medium	Use-after-free in the DOM: Core & HTML component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109724 medium	Use-after-free in the DOM: Core & HTML component. This vulnerability w ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109723 medium	Integer overflow in the Layout: Text and Fonts component. This vulnera ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109722 medium	JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109721 medium	Incorrect boundary conditions in the JavaScript Engine: JIT component. ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109720 medium	JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026
CVE-2026-109718 medium	Use-after-free in the XML component. This vulnerability was fixed in F ...	since at least 24 Oct 202607:11 UTC build	13 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.