Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-103267 medium	Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103263 medium	tornado: Tornado: Information disclosure via symlink path traversal in StaticFileHandler	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103261 medium	tornado: tornado: Denial of Service (DoS) via unbounded query string parsing	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
CVE-2026-103641 medium	gegl: gegl04: gegl: out-of-bounds read in the Radiance HDR uncompressed scanline decoder	since at least 24 Oct 202607:11 UTC build	1 Oct 2026
GHSA-3hv7-mjh2-fv65 medium	Tornado: Unbounded query-string argument count allows event-loop-stalling DoS	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
GHSA-59cr-6r3x-644w medium	GitPython submodule update path traversal can write outside the repository	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
GHSA-whh4-5q6c-9v3x medium	GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-103001 medium	pyjwt: pyjwt: Token validation bypass via options dictionary mutation	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-103387 medium	uri-js: uri-js: Denial of Service via crafted mailto URI	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-102991 medium	Mako: Path traversal via drive-letter URI on Windows in TemplateLookup	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-103500 medium	thunderbird: thunderbird: Heap buffer overflow via opening large emails	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-103399 medium	libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47604 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Information disclosure via missing authorization checks	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47603 medium	nvidia-driver: nvidia-driver: Information disclosure via missing authorization in kernel mode driver	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47598 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via use-after-free in event delivery path	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47586 medium	nvidia-driver: nvidia-driver: arbitrary code execution via kernel module use-after-free	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47584 medium	nvidia-driver: nvidia-driver: Denial of Service via NULL pointer dereference in kernel module	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47582 medium	nvidia-driver: nvidia-driver: Code execution via out-of-bounds write in kernel module	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47579 medium	nvidia-driver: nvidia-driver: arbitrary code execution via use-after-free in kernel mode driver	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47568 medium	nvidia-driver: nvidia-driver: Denial of Service via uncontrolled kernel logging	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47567 medium	nvidia-driver: nvidia-driver: Denial of Service via DRM VMA address space exhaustion	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47566 medium	nvidia-driver: nvidia-driver: Denial of Service via kernel memory leak	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47565 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via kernel mode race condition	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47562 medium	nvidia-driver: nvidia-driver: Denial of Service via kernel log injection	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47557 medium	nvidia-driver: nvidia-driver: Denial of Service via NULL pointer dereference in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47555 medium	nvidia-driver: nvidia-driver: Information disclosure via uninitialized kernel memory copy	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47549 medium	nvidia-driver: nvidia-driver: Denial of Service via NULL pointer dereference in kernel module	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47547 medium	nvidia-driver: nvidia-driver: Arbitrary code execution via improper input validation in firmware	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47546 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via improper input validation in firmware	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47543 medium	nvidia-driver: nvidia-driver: arbitrary code execution via improper input validation in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47542 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via improper input validation in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47538 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via firmware out-of-bounds write	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47537 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via out-of-bounds write in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47534 medium	nvidia-driver: nvidia-driver: Denial of Service via divide-by-zero in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47533 medium	nvidia-driver: nvidia-driver: arbitrary code execution via kernel-mode array indexing flaw	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47532 medium	nvidia-driver: nvidia-driver: Arbitrary code execution via kernel mode out-of-bounds write	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47531 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Denial of Service via null pointer dereference in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47529 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: arbitrary code execution via out-of-bounds write in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47527 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via firmware out-of-bounds read	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47526 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Denial of Service via null pointer dereference in firmware	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47525 medium	nvidia-driver: nvidia-driver: Arbitrary code execution via improper array index validation	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47524 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via out-of-bounds read	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47522 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Arbitrary code execution via improper input validation in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47518 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Code execution via improper permission assignment in secure microcontroller	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47517 medium	nvidia-driver: nvidia-driver: Denial of Service via crafted ioctl request	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47515 medium	nvidia-driver: nvidia-driver: Arbitrary code execution via kernel-mode unbounded string operation	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47509 medium	nvidia-driver: nvidia-driver: Arbitrary code execution via out-of-bounds write in kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-47492 medium	nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Denial of Service via improper access control in the kernel mode layer	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
GHSA-97jj-33gv-5xf9 medium	league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal	since at least 24 Oct 202607:11 UTC build	30 Sep 2026
CVE-2026-102983 medium	Astro: Netlify Image CDN allowlist bypass enables SSRF	since at least 24 Oct 202607:11 UTC build	30 Sep 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.