Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 13:12 UTC

23critical, last 7 days 298high, last 7 days 633medium, last 7 days 139low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-95388 medium	wireshark: wireshark: Denial of Service via heap-based buffer overflow in sharkd	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-95386 medium	wireshark: wireshark: Denial of Service via infinite loop in TTL file parser	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-8937 medium	Missing Authorization in GitLab	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-15390 medium	Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP reassemb ...	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-10518 medium	Incorrect Authorization in GitLab	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102474 medium	dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102473 medium	dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-97029 medium	flatpak: flatpak: Sandboxed app can signal unsandboxed processes in the same process group	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
CVE-2026-102414 medium	pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...	since at least 24 Oct 202607:11 UTC build	29 Sep 2026
GHSA-6vj9-mwq6-2f5v medium	Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-102277 medium	brace-expansion: brace-expansion: Denial of Service via crafted brace patterns	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-102270 medium	pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-102269 medium	pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-102265 medium	pyjwt: pyjwt: Denial of Service via deeply nested token headers	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101914 medium	@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-102010 medium	gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-55156 medium	Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101913 medium	ip-address: ip-address: Security bypass via incomplete IPv6 link-local address validation	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101912 medium	ip-address: ip-address: Access control bypass via cross-family subnet comparison	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101911 medium	ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101910 medium	ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101908 medium	axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101907 medium	axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101904 medium	axios: Axios: HTTP header injection via inherited prototype properties	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101902 medium	axios: axios: Unintended HTTP method override via prototype pollution gadget	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101900 medium	axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101898 medium	axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101101 medium	ag-ui: ag-ui: Denial of Service via uncaught JSON parsing exception	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101100 medium	@ag-ui/client: ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-88816 medium	perl-DBI: perl-DBI: Denial of Service via numeric FetchHashKeyName attribute	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101333 medium	keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-19444 medium	k8s.io/kubectl: Kubernetes kubectl: Arbitrary file write via path traversal on Windows	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-94287 medium	libXpm: libXpm: Denial of Service via unsigned integer underflow	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-94285 medium	libX11: libX11: Denial of Service via out-of-bounds read in byte-oriented codeset parser	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-94284 medium	libX11: libX11: Denial of Service via out-of-bounds read in XIM trigger-key registration parser	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-94283 medium	libX11: libX11: Denial of Service via out-of-bounds read in XIM attribute parser	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-94282 medium	libXi: libXi: Denial of Service via out-of-bounds read in XI2 event processing	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101017 medium	opendmarc: OpenDMARC: Denial of Service via NULL pointer dereference during subdomain walking in opendmarc_policy.c	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101016 medium	opendmarc: OpenDMARC: Improper policy enforcement via malformed DMARC record tags	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-101003 medium	mongoose: mongoose: Denial of Service via stack-based buffer overflow in MQTT broker	since at least 24 Oct 202607:11 UTC build	28 Sep 2026
CVE-2026-96281 medium	flatpak: flatpak: Unprivileged active user can bypass anti-downgrade checks for system apps/runtimes	since at least 24 Oct 202607:11 UTC build	27 Sep 2026
CVE-2026-96280 medium	flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems	since at least 24 Oct 202607:11 UTC build	27 Sep 2026
CVE-2026-96279 medium	flatpak: flatpak: Path traversal issue in OCI archive extraction via hardlinks	since at least 24 Oct 202607:11 UTC build	27 Sep 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.