Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-95301 high	chromium-browser: Missing authorization in Extensions	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95299 high	chromium-browser: Use after free in GPU	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95298 high	chromium-browser: Use after free in Browser	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95293 high	chromium-browser: Uninitialized resource in GPU	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95291 high	chromium-browser: UI misrepresentation in SecurityIndicators	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95286 high	chromium-browser: Type confusion in Bindings	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95284 high	chromium-browser: angle: Buffer overflow in ANGLE	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95283 high	chromium-browser: Buffer overflow in Tint	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95282 high	chromium-browser: Use after free in Platform	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95281 high	chromium-browser: angle: Buffer overflow in ANGLE	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95280 high	chromium-browser: Race condition in V8	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95277 high	chromium-browser: Use after free in Views	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95274 high	chromium-browser: Improper output encoding in DevTools	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102677 high	electron: Electron: Privilege escalation via sandboxed preload code cache poisoning	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102559 high	libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102558 high	libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102555 high	libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92227 high	Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92222 high	Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-90906 high	Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102675 high	electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102557 high	libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102556 high	libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-97689 high	urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-97687 high	urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-84782 high	openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102600 high	Socket.IO: Prototype Pollution via Unsafe Client Session Lookup	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100308 high	gluonts: gluonts: Arbitrary command execution via untrusted model deserialization	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-68911 high	nicotine-plus: nicotine-plus: Denial of Service via decompression bomb in peer messages	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-63209 high	github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100832 high	firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100811 high	firefox: firefox: Sandbox escape via use-after-free in DOM component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100793 high	firefox: JIT miscompilation in the JavaScript Engine component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100792 high	firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100791 high	firefox: Use-after-free in the DOM: Core & HTML component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100790 high	firefox: thunderbird: Use-after-free in the XSLT component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100789 high	firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100788 high	firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100787 high	firefox: Sandbox escape in the XUL component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100786 high	firefox: Sandbox escape due to use-after-free in the Graphics component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100785 high	firefox: thunderbird: Use-after-free in the DOM: Core & HTML component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100784 high	firefox: Use-after-free in the Layout: Text and Fonts component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100783 high	firefox: thunderbird: Uninitialized memory in the Audio/Video component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100782 high	firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100781 high	firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100780 high	firefox: thunderbird: Use-after-free in the DOM: Core & HTML component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100779 high	firefox: thunderbird: Use-after-free in the XSLT component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100778 high	firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100777 high	firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-100776 high	firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component	since at least 24 Oct 202607:11 UTC build	29 Sep 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.