Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-86536 medium	thrift: thrift: Prototype pollution in JavaScript bindings	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104417 medium	Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104412 medium	Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-97876 medium	grub2: grub2: Secure Boot lockdown bypass via improper serial address validation	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-85483 medium	thrift: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-95512 medium	freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-86345 medium	389-ds-base: 389-ds-base: StartTLS plaintext-buffer retention allows on-path attacker to forge an LDAP client's authentication result	since at least 24 Oct 202607:11 UTC build	2 Oct 2026
CVE-2026-104183 medium	stream-json: stream-json: Object prototype manipulation via crafted JSON input	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-104182 medium	stream-json: stream-json: Denial of Service via inefficient comment scanning	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-104181 medium	Filament: Multi-factor authentication (app) management actions do not require password reauthentication	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-55252 medium	OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-104056 medium	authlib: authlib: Information disclosure via unvalidated discovery metadata	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-56098 medium	rubygem-katello: improper authorization logic allows resource enumeration	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-56097 medium	rubygem-katello: SQL injection in Registry Proxy via labels	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-12545 medium	rubygem-hammer_cli: command injection via insecure editor invocation	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103923 medium	katex: katex: Cross-site scripting via prototype pollution inheritance	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103884 medium	A flaw was found in the X.509 client certificate authenticator of Keycloak.	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-93546 medium	httpd: httpd: Denial of Service via integer overflow in mod_dav_fs	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-79768 medium	httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-77387 medium	geopy: geopy: Denial of Service via inefficient regular expression coordinate parsing	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-73637 medium	httpd: httpd: Authentication state corruption via concurrent Digest authentication requests	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-63045 medium	httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-59797 medium	httpd: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-58415 medium	httpd: httpd: Information disclosure via direct request to the WebDAV state directory	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-57941 medium	httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-42528 medium	httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103505 medium	github.com/kubernetes-sigs/aws-efs-csi-driver: AWS EFS CSI Driver: Arbitrary mount option injection via mounttargetipmap attribute	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
GHSA-hx4r-w6wj-j8fg medium	devalue: Residual sparse-array CPU amplification in uneval	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103004 medium	next: Next.js: Information disclosure via cache key omission in nested cache handlers	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
GHSA-4q55-j62x-fr9h medium	devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-94276 medium	Apache APISIX: Openid-connect introspection validation issue	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-94269 medium	Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-94212 medium	Apache APISIX: unauthenticated impersonation issue in saml-auth	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103754 medium	ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103680 medium	A flaw was found in tnef. A heap-based buffer overflow can occur in th ...	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-82806 medium	Apache APISIX: cross-request permission pollution via static permission list mutation	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-78242 medium	Apache APISIX: data-mask may fail to redact request headers in logger output	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103291 medium	Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103290 medium	Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103287 medium	Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103285 medium	Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103284 medium	Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103282 medium	Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103281 medium	Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103280 medium	Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103276 medium	Ghost before 6.20.0 File Read via URL Encoding Bypass	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103275 medium	Ghost 5.42.2 before 6.58.0 Password Hash Disclosure	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103274 medium	Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103273 medium	Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103269 medium	Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts	since at least 24 Oct 202607:11 UTC build	1 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.