Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-95370 medium	chromium-browser: Inappropriate implementation in NFC	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95369 medium	chromium-browser: Inappropriate implementation in XML	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95366 medium	chromium-browser: Use of released resource in Core	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95363 medium	chromium-browser: UI misrepresentation in FileSystem	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95362 medium	chromium-browser: Cross-site request forgery in DevTools	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95360 medium	chromium-browser: Race condition in Editing	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95359 medium	chromium-browser: Uninitialized resource in GPU	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95358 medium	chromium-browser: Incorrect authorization in Mobile	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95354 medium	chromium-browser: Use after free in Verifier	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95353 medium	chromium-browser: Use after free in Bindings	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95347 medium	chromium-browser: Use after free in Updater	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95346 medium	chromium-browser: UI misrepresentation in Chromoting	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95345 medium	chromium-browser: Use after free in Actor	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95344 medium	chromium-browser: Race condition in DevTools	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95341 medium	chromium-browser: Improper input validation in Desktop	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95337 medium	chromium-browser: UI misrepresentation in Messages	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95336 medium	chromium-browser: Information leak in Transactions Platform	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95333 medium	chromium-browser: Use after free in Metrics	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95332 medium	chromium-browser: Use of uninitialized variable in Tint	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95331 medium	chromium-browser: angle: Out of bounds write in ANGLE	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95330 medium	chromium-browser: Improper state validation in Downloads	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95325 medium	chromium-browser: angle: Use after free in ANGLE	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95323 medium	chromium-browser: UI misrepresentation in Chromium	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95321 medium	chromium-browser: UI misrepresentation in Payments	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95320 medium	chromium-browser: Missing authorization in Navigation	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95317 medium	chromium-browser: Incorrect authorization in MediaCapture	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95314 medium	chromium-browser: Incorrect authorization in HID	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95312 medium	chromium-browser: Information leak in Passwords	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95311 medium	chromium-browser: Free of non-heap memory in Fonts	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95303 medium	chromium-browser: Incomplete cleanup in SmartCard	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95302 medium	chromium-browser: Incorrect authorization in WebAPKs	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95300 medium	chromium-browser: Missing authorization in DevTools	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95297 medium	chromium-browser: Missing authorization in Contextual Tasks	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95295 medium	chromium-browser: Information leak in Mobile	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95294 medium	chromium-browser: UI misrepresentation in Browser	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95290 medium	chromium-browser: Missing authorization in NFC	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95289 medium	chromium-browser: Incorrect authorization in Scroll	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95287 medium	chromium-browser: Missing authorization in Navigation	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95276 medium	chromium-browser: Improper input validation in Themes	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95275 medium	chromium-browser: Incorrect reference resolution in MediaStream	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-12345 medium	python: python: Arbitrary file deletion via race condition during temporary directory cleanup	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
GHSA-253c-mchw-3w2r medium	markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
GHSA-r3ph-w7gj-g6xm medium	js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92232 medium	Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92231 medium	Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92226 medium	Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92225 medium	Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-92224 medium	Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-90918 medium	Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-90917 medium	Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3	since at least 24 Oct 202607:11 UTC build	29 Sep 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.