Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
GHSA-4wwp-f6gw-6qm5 medium	SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
GHSA-3cm4-ccvw-6xr6 medium	SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-63270 medium	libreoffice: LibreOffice: Information disclosure via crafted document URLs	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-63269 medium	libreoffice: LibreOffice: Information disclosure via malicious HLS media playlists	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-63268 medium	libreoffice: libreoffice: Information disclosure via external SQL data source links	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-63267 medium	libreoffice: libreoffice: Information disclosure via automatic external CSV link loading	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-63266 medium	libreoffice: LibreOffice: Arbitrary file write via embedded Firebird database links	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59788 medium	zabbix: Zabbix: Arbitrary script execution via unvalidated OAuth authorization endpoint URL	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59787 medium	zabbix: zabbix: Trap record injection via unsanitized delimiter in SNMP trap receiver	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59786 medium	zabbix: zabbix: Host status spoofing via unauthenticated active agent heartbeats	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59785 medium	zabbix: zabbix: Information disclosure via frontend host search filtering	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59783 medium	zabbix: Zabbix: Denial of service via null byte input in binary items	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-59782 medium	zabbix: Zabbix: Information disclosure via the JavaScript preprocessing engine	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-105306 medium	keycloak-services: keycloak-services: Token introspection audience bypass via Dynamic Client Registration	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-105302 medium	keycloak-services: keycloak-services: User Session Note mapper exposes upstream IdP access tokens	since at least 24 Oct 202607:11 UTC build	5 Oct 2026
CVE-2026-97873 medium	org.bouncycastle:bcprov-jdk18on: org.bouncycastle:bcprov-lts8on: bouncycastle: org.bouncycastle:bcprov-jdk15on: bouncycastle: Denial of Service via unbounded iteration count in password-based encryption	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
CVE-2026-71892 medium	org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: bouncycastle: Bouncy Castle: Key-size validation bypass via improper algorithm check	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
CVE-2026-71886 medium	bouncycastle: org.bouncycastle:bcpg-jdk18on: org.bouncycastle:bcpg-jdk15to18: bouncycastle: Unauthorized trust delegation via unverified subkey certification flags	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
CVE-2026-18040 medium	bouncycastle: bcprov-jdk18on: bouncycastle: Information disclosure via cryptographic side channels in HQC	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
CVE-2026-105083 medium	ImageMagick: ImageMagick: Security policy bypass via alternate XML DOCTYPE declaration	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
CVE-2026-104477 medium	showdown: showdown: Cross-site scripting via unescaped double quotes in link and image attributes	since at least 24 Oct 202607:11 UTC build	3 Oct 2026
GHSA-p23f-cm6q-2qp8 medium	SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-mwm8-39rw-8826 medium	Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-fj2x-mqqp-3v2w medium	Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-4672-hwv6-gq62 medium	Trigger.dev: Cross-environment deployment cancel	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-59h8-w5q6-mfmp medium	Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-q567-cr4x-96w4 medium	Trigger.dev: Blind SSRF via alert-channel webhook	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104874 medium	multidict: multidict: Denial of Service via memory leak in items-view operations	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104872 medium	@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104871 medium	Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-103918 medium	@orpc/zod: Prototype injection in smart coercion	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-35mr-4567-66vg medium	Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104855 medium	wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-102795 medium	trafficserver: trafficserver: Security restriction bypass via improper access control	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104853 medium	nx: Nx: Arbitrary file write via path traversal in migration planning	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94544 medium	next: Next.js: Information disclosure via shared cache fills in Draft Mode	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94543 medium	next: Next.js: Response cache poisoning via improper route binding	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94486 medium	next: Next.js: Information disclosure via unrestricted cross-site requests	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94485 medium	next: Next.js: Information disclosure via unrestricted cross-site requests on development server	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94484 medium	next: Next.js: Denial of Service via response cache poisoning	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94483 medium	next: Next.js: Information disclosure via SSRF in Image Optimization	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104844 medium	postcss-selector-parser: postcss-selector-parser: Denial of Service via crafted CSS selectors	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-103627 medium	chromium-browser: Information leak in SVG	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
GHSA-c9xm-49cp-xcr9 medium	rmcp OAuth client fetches server-controlled resource_metadata URLs	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104721 medium	ch.qos.logback/logback-classic: logback-classic: Arbitrary file write via path traversal in MDC discriminator	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-83632 medium	thrift: Apache Thrift: Denial of Service via crafted HTTP requests	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-66331 medium	thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94652 medium	thrift: thrift: Denial of Service via memory leak in C++ bindings	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-94638 medium	thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-92834 medium	thrift: Apache Thrift: C++ WebSocket server transport does not read a full request length	since at least 24 Oct 202607:11 UTC build	2 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.