Attestkeep
Language: English
Sign up
Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC
29critical, last 7 days411high, last 7 days649medium, last 7 days145low, last 7 days
IDVulnerabilityRated sincePublished
CVE-2026-98660
medium		kernel: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup01:25 UTC build
CVE-2026-98658
medium		kernel: iio: proximity: aw96103: validate firmware data length01:25 UTC build
CVE-2026-98657
medium		kernel: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure01:25 UTC build
CVE-2026-98656
medium		kernel: iio: trigger: cancel reenable_work before freeing trigger01:25 UTC build
CVE-2026-98652
medium		kernel: KVM: s390: Add missing srcu in kvm_s390_set_irq_state()01:25 UTC build
CVE-2026-98647
medium		kernel: bpf: Fix divide-by-zero in btf_struct_walk()01:25 UTC build
CVE-2026-98645
medium		kernel: HID: winwing: fix use-after-free in force feedback teardown01:25 UTC build
CVE-2026-98642
medium		kernel: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk01:25 UTC build
CVE-2026-98641
medium		kernel: bpf, arm64: set up the frame pointer for the exception callback01:25 UTC build
CVE-2026-98638
medium		kernel: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()01:25 UTC build
CVE-2026-98636
medium		kernel: squashfs: Add dictionary size range check to prevent shift-out-of-bounds01:25 UTC build
CVE-2026-98632
medium		kernel: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel01:25 UTC build
CVE-2026-98627
medium		kernel: bpf: Preserve packet pointer class displacement in regsafe()01:25 UTC build
CVE-2026-98626
medium		kernel: bpf: Restrict CO-RE poisoning to relocatable instructions01:25 UTC build
CVE-2026-98625
medium		kernel: netfilter: flowtable: publish HW_DEAD after worker is done01:25 UTC build
CVE-2026-98624
medium		kernel: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier01:25 UTC build
CVE-2026-98623
medium		kernel: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update01:25 UTC build
CVE-2026-98620
medium		kernel: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure01:25 UTC build
CVE-2026-98619
medium		kernel: net: ethtool: keep rtnl_lock for the ioctl self test01:25 UTC build
CVE-2026-98618
medium		kernel: eth: fbnic: Handle maximum standalone channels01:25 UTC build
CVE-2026-98617
medium		kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector01:25 UTC build
CVE-2026-98616
medium		kernel: eth: fbnic: reset num_napi when the napi vectors are freed01:25 UTC build
CVE-2026-98615
medium		kernel: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox01:25 UTC build
CVE-2026-98602
medium		kernel: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough01:25 UTC build
CVE-2026-98600
medium		kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()01:25 UTC build
CVE-2026-98599
medium		kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi()01:25 UTC build
CVE-2026-98593
medium		kernel: s390/debug: Fix NULL pointer dereference in debug_info_copy()01:25 UTC build
CVE-2026-98590
medium		kernel: bpf: Fix bpf_sock context code generation01:25 UTC build
CVE-2026-98589
medium		kernel: bpf: Reject pkt arguments in mutating subprogs01:25 UTC build
CVE-2026-98587
medium		kernel: firewire: cdev: fix back-transition for iso_resource_auto client resource01:25 UTC build
CVE-2026-98586
medium		kernel: sctp: hold asoc or transport before mod_timer() in timer handlers01:25 UTC build
CVE-2026-98583
medium		kernel: nfc: nfcmrvl: validate helper command length before pull01:25 UTC build
CVE-2026-98578
medium		kernel: nfc: st21nfca: validate ISO15693 inventory length01:25 UTC build
CVE-2026-98576
medium		kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names01:25 UTC build
CVE-2026-98574
medium		kernel: net: bcmgenet: stop Tx NAPI before disabling the queues01:25 UTC build
CVE-2026-98572
medium		kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS3201:25 UTC build
CVE-2026-98571
medium		kernel: net: stmmac: clear stale buf->page after recycling on skb build failure01:25 UTC build
CVE-2026-98570
medium		kernel: net: ipv6: keep room for the mac header in dst_dev_overhead()01:25 UTC build
CVE-2026-98568
medium		kernel: vxlan: use one headroom snapshot for neighbour replies01:25 UTC build
CVE-2026-98566
medium		kernel: drm/imagination: clamp freelist reconstruction requests01:25 UTC build
CVE-2026-98565
medium		kernel: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT762101:25 UTC build
CVE-2026-98564
medium		kernel: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq01:25 UTC build
CVE-2026-98563
medium		kernel: net: phylink: record the PHY only once bringup cannot fail01:25 UTC build
CVE-2026-98562
medium		kernel: net: libwx: fix races in Tx timestamp handling01:25 UTC build
CVE-2026-98559
medium		kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err()01:25 UTC build
CVE-2026-98557
medium		kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO01:25 UTC build
CVE-2026-98544
medium		kernel: bna: prevent IOC timer rearm during teardown01:25 UTC build
CVE-2026-98540
medium		kernel: fprobe: Terminate the fgraph_data list when the reservation is not filled01:25 UTC build
CVE-2026-98539
medium		kernel: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga01:25 UTC build
CVE-2026-98534
medium		kernel: ipe: fix use-after-free when auditing a newly loaded policy01:25 UTC build

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.