Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-95502 medium	grafana: grafana: Denial of Service via oversized Git Sync responses	27 Oct 202601:25 UTC build	13 Oct 2026
CVE-2026-107819 medium	mariadb-connector-c: mariadb-connector-c: Information disclosure via improper TLS hostname verification	27 Oct 202601:25 UTC build	9 Oct 2026
CVE-2026-107817 medium	mariadb: mariadb: Denial of Service via invalid binary JSON in mysql_json plugin	27 Oct 202601:25 UTC build	9 Oct 2026
CVE-2026-106061 medium	gimp: GIMP: heap buffer over-read in X cursor (XMC) thumbnail loader on crafted file	27 Oct 202601:25 UTC build	7 Oct 2026
CVE-2026-80048 medium	sssd: sssd-kcm: Local Denial of Service via excessive memory preallocation	27 Oct 202601:25 UTC build	7 Oct 2026
CVE-2026-104046 medium	sssd: sssd: Denial of Service via incomplete Identity Provider authentication requests	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-106063 medium	GIMP: GIMP: heap buffer overflow in DICOM export on oversized image dimensions	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104047 medium	sssd: sssd: Information disclosure via query injection in Entra ID lookups	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-98359 medium	kernel: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-98169 medium	kernel: smb: client: fix potential OOB read in smb3_enum_snapshots()	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-92821 medium	sssd: SSSD: Access control bypass via premature LDAP access rule evaluation	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104038 medium	sssd: sssd: Denial of Service via missing SID extension in certificate mapping	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104036 medium	sssd: sssd: Denial of service via out-of-bounds write in NFS idmap plugin	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104034 medium	sssd: SSSD: Denial of Service via use-after-free in KCM ticket renewal	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104032 medium	sssd: sssd: Denial of Service via unprivileged autofs cache invalidation	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104031 medium	sssd: SSSD: Denial of Service via memory exhaustion in autofs responder	27 Oct 202601:25 UTC build	6 Oct 2026
CVE-2026-104030 medium	sssd: sssd: Denial of Service via out-of-bounds read during passkey parsing	27 Oct 202601:25 UTC build	5 Oct 2026
CVE-2026-103531 medium	opensc: opensc: Arbitrary code execution via stack-based buffer overflow in card-setcos	27 Oct 202601:25 UTC build	1 Oct 2026
CVE-2026-103242 medium	rpm: Heap-based buffer overflow write in hex2binv() via a mistyped RPMTAG_FILESIGNATURES header tag	27 Oct 202601:25 UTC build	30 Sep 2026
CVE-2026-95520 medium	rpm: rpm: integer overflow in iterReadArchiveNext() leads to heap-based buffer overflow when parsing untrusted RPM packages	27 Oct 202601:25 UTC build	29 Sep 2026
CVE-2026-98120 medium	kernel: netfs: Fix subreq ref leak	27 Oct 202601:25 UTC build	25 Sep 2026
CVE-2026-98119 medium	kernel: netfs: break unbuffered write when netfs_alloc_subrequest() fails	27 Oct 202601:25 UTC build	25 Sep 2026
CVE-2026-88383 medium	libical: libical: Denial of Service via crafted iCalendar property parsing	27 Oct 202601:25 UTC build	24 Sep 2026
CVE-2026-49919 medium	freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering	27 Oct 202601:25 UTC build	8 Sep 2026
CVE-2026-116196 medium	github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend	26 Oct 202619:14 UTC build	25 Oct 2026
CVE-2026-116195 medium	github.com/rclone/rclone: rclone: Path traversal via link suffix trimming	26 Oct 202619:14 UTC build	25 Oct 2026
CVE-2026-116194 medium	github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback	26 Oct 202619:14 UTC build	25 Oct 2026
CVE-2026-116192 medium	github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve	26 Oct 202619:14 UTC build	25 Oct 2026
CVE-2026-116187 medium	github.com/rclone/rclone: rclone: Cross-tenant upload tampering via authorization bypass in S3 authentication proxy	26 Oct 202619:14 UTC build	25 Oct 2026
CVE-2026-80785 medium	kernel: fbdev: serialize mode sysfs access with lock_fb_info()	26 Oct 202619:14 UTC build	4 Sep 2026
CVE-2026-74690 medium	kernel: s390/ism: Fix UAF of sba and ieq during ism_dev_exit()	26 Oct 202619:14 UTC build	22 Aug 2026
CVE-2026-63862 medium	kernel: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found	26 Oct 202619:14 UTC build	19 Jul 2026
CVE-2026-116470 medium	keycloak-services: keycloak-services: SCIM user listing endpoint returns full PII without per-user VIEW authorization check	26 Oct 202619:14 UTC build
GHSA-x65r-p6hf-94hv medium	Missing authorization on Avo association show endpoint exposes related records	26 Oct 202619:14 UTC build
openSUSE-SU-2026:12259-1 medium	MozillaFirefox-158.0.1-1.1 on GA media	26 Oct 202619:14 UTC build
openSUSE-SU-2026:12260-1 medium	buildpacks-cli-0.40.10-1.1 on GA media	26 Oct 202619:14 UTC build
openSUSE-SU-2026:12263-1 medium	nvidia-open-driver-G06-signed-check-580.196.07-1.1 on GA media	26 Oct 202619:14 UTC build
openSUSE-SU-2026:12265-1 medium	python313-wyoming-1.10.2-1.1 on GA media	26 Oct 202619:14 UTC build
openSUSE-SU-2026:12266-1 medium	libvips-devel-8.18.7-1.1 on GA media	26 Oct 202619:14 UTC build
openSUSE-SU-2026:22163-1 medium	Security update for rabbitmq-server	26 Oct 202619:14 UTC build
openSUSE-SU-2026:22165-1 medium	Security update for libmodplug	26 Oct 202619:14 UTC build
CVE-2026-112768 medium	Parse Server before 8.6.99 and 9.x before 9.10.3 Information Disclosure via User Update	26 Oct 202614:38 UTC build	19 Oct 2026
CVE-2026-116181 medium	vllm: vllm: Denial of Service via unvalidated stop token identifiers	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116180 medium	vllm: vLLM: Denial of Service via uninitialized log probability tensors	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116178 medium	vllm: vLLM: Denial of Service via inconsistent multimodal metadata	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116175 medium	vllm: vllm: Denial of Service via audio decompression bomb in chat completions	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116174 medium	vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116173 medium	vllm: vllm: Denial of Service via excessive candidate token IDs in gRPC interface	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116172 medium	vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116155 medium	ImageMagick: ImageMagick: Denial of Service via crafted XMP profile memory leak	26 Oct 202607:15 UTC build	25 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.