Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 13:12 UTC

23critical, last 7 days 298high, last 7 days 633medium, last 7 days 139low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-83376 low	openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113731 low	djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113140 low	chromium-browser: angle: Use after free in ANGLE	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113029 low	chromium-browser: angle: Improper access control in ANGLE	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-101779 low	mysql: mysql: Partial Denial of Service via Telemetry component	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-101513 low	mysql: mysql: Denial of Service via physical access	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-94266 low	curl: curl: password leak in CURLINFO_EFFECTIVE_URL	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-94265 low	curl: curl: Authorization: Negotiate sent to foreign origin	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92391 low	curl: curl: curl_mime_free stack overflow by recursion	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92390 low	curl: curl: -J no-clobber guarantee bypassed with 103 early hints	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92389 low	curl: curl: TFTP direction confusion	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92387 low	curl: curl: never-ending loop via server response omission	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-92386 low	curl: curl: server-set cookie aborts cookie jar load	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87866 low	curl: curl: wolfSSL public-key pinning bypass	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87865 low	curl: curl: knownhost callback mismatches key as missing	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87864 low	curl: IMAP APPEND plus CRLF conversion command injection	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87863 low	curl: curl: Hsts Response Erases Persisted Entries	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87862 low	curl: curl: HSTS cache import drops longer-lived child	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-87861 low	curl: curl: cross-origin reuse of a Negotiate connection	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86415 low	curl: curl: auto client cert connection reuse mixup	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86414 low	curl: curl: leaking host credentials to HTTP proxy	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-107929 low	curl: curl: local interface connection reuse mixup	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-107928 low	curl: curl: info leak uploading over WebSockets with GnuTLS	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86413 low	curl: curl: Negotiate credentials sent to redirected origin	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86412 low	curl: curl: server-set cookie erases cookie jar	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86411 low	curl: curl: FTP connection reuse inherits client-certificate	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86410 low	curl: curl: redirect to SFTP or SCP bypasses host verification	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-86409 low	curl: curl: stale SigV4 headers sent unintended	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113665 low	ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113657 low	sanitize-html: sanitize-html: arbitrary script execution via namespace-prefixed SVG animation elements	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113651 low	ApostropheCMS: Path traversal in uploadfs	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-113648 low	ApostropheCMS: Missing Authentication in `cleanExport` Route	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112946 low	vite: Vite: Information disclosure via improper module path handling	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112941 low	filelock: filelock: Unauthorized file write via lock directory replacement	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-112912 low	filelock: filelock: Information disclosure via symbolic link following in SoftFileLock	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-88041 low	tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-80353 low	tomcat: tomcat: Unauthorized socket access via TOCTOU race condition	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-74049 low	tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-74048 low	tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-110725 low	fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-110095 low	fast-uri: fast-uri: Path traversal via improper relative URI normalization	since at least 24 Oct 202607:11 UTC build	20 Oct 2026
CVE-2026-111766 low	markdown-it: markdown-it: Denial of Service via repeated unterminated inline HTML constructs	since at least 24 Oct 202607:11 UTC build	19 Oct 2026
CVE-2026-111063 low	aiohttp: aiohttp: Information disclosure via unenforced Secure attribute on shared cookies	since at least 24 Oct 202607:11 UTC build	19 Oct 2026
CVE-2026-112310 low	docling-core: docling-core: information disclosure via plain filesystem paths in image references	since at least 24 Oct 202607:11 UTC build	19 Oct 2026
CVE-2026-112026 low	cms: light0011 cms: Information disclosure via weak password hashing	since at least 24 Oct 202607:11 UTC build	18 Oct 2026
CVE-2026-98860 low	kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request	since at least 24 Oct 202607:11 UTC build	18 Oct 2026
CVE-2026-98851 low	kernel: netfilter: nft_flow_offload: drop flowtable reference on init error path	since at least 24 Oct 202607:11 UTC build	18 Oct 2026
CVE-2026-98831 low	kernel: of/overlay: don't leak fragment references when changeset init fails	since at least 24 Oct 202607:11 UTC build	18 Oct 2026
CVE-2026-98817 low	In the Linux kernel, the following vulnerability has been resolved: A ...	since at least 24 Oct 202607:11 UTC build	18 Oct 2026
CVE-2026-98784 low	kernel: drm/amdgpu/gfx6: fix firmware leak on teardown	since at least 24 Oct 202607:11 UTC build	18 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.