Vulnerabilities

Critical vulnerabilities the gate already knows.

Every six hours Attestkeep pulls the Trivy vulnerability database, the same one its scanner reads inside your cluster. These are the entries the database rated critical this week, and when it did. Not when the news broke: when the gate knew.

Database last updated27 Oct 2026, 19:17 UTC

29critical, last 7 days 411high, last 7 days 649medium, last 7 days 145low, last 7 days

ID	Vulnerability	Rated since	Published
CVE-2026-116154 medium	ImageMagick: ImageMagick: Denial of Service via XML parsing memory leak	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-116141 medium	ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder	26 Oct 202607:15 UTC build	25 Oct 2026
CVE-2026-80905 medium	kernel: net: tap: fix wrong transport_header when sending VLAN-tagged frame	26 Oct 202607:15 UTC build	4 Sep 2026
CVE-2026-80887 medium	kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound	26 Oct 202607:15 UTC build	4 Sep 2026
CVE-2026-80883 medium	kernel: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered	26 Oct 202607:15 UTC build	4 Sep 2026
CVE-2026-72262 medium	kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get	26 Oct 202607:15 UTC build	15 Aug 2026
CVE-2026-93453 medium	SOGo before 5.12.11 constructs password-reset links using the client-s ...	25 Oct 202619:10 UTC build	18 Sep 2026
CVE-2024-56830 medium	The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builti ...	25 Oct 202619:10 UTC build	2 Jan 2025
CVE-2024-31837 medium	DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string ...	25 Oct 202619:10 UTC build	30 Apr 2024
CVE-2026-96405 medium	NLnet Labs Unbound up to and including version 1.26.1 limits compressi ...	25 Oct 202607:10 UTC build	21 Oct 2026
CVE-2026-50106 medium	When NLnet Labs Unbound up to and including version 1.26.1 is configur ...	25 Oct 202607:10 UTC build	21 Oct 2026
CVE-2026-35501 medium	When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is co ...	25 Oct 202607:10 UTC build	21 Oct 2026
CVE-2026-109125 medium	In NLnet Labs Unbound up to and including version 1.26.1, an observabl ...	25 Oct 202607:10 UTC build	21 Oct 2026
CVE-2026-101283 medium	iperf3 3.20\u20133.21 (esnet/iperf) has a pre-auth heap buffer overflo ...	25 Oct 202607:10 UTC build	30 Sep 2026
CVE-2026-63318 medium	ELSA-2026-500245: qemu-kvm security update (IMPORTANT)	25 Oct 202607:10 UTC build
CVE-2026-65928 medium	ELSA-2026-500245: qemu-kvm security update (IMPORTANT)	25 Oct 202607:10 UTC build
CVE-2026-98867 medium	kernel: dm-pcache: bound the logical key offset from persistent memory	24 Oct 202619:09 UTC build	18 Oct 2026
CVE-2026-98865 medium	kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held	24 Oct 202619:09 UTC build	18 Oct 2026
CVE-2026-89810 medium	kernel: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram	24 Oct 202619:09 UTC build	16 Sep 2026
CVE-2026-80891 medium	kernel: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages	24 Oct 202619:09 UTC build	4 Sep 2026
openSUSE-SU-2026:12231-1 medium	bind-9.20.30-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12232-1 medium	brotli-1.2.1-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12234-1 medium	chromedriver-156.0.8078.47-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12236-1 medium	docker-compose-5.6.1-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12237-1 medium	git-lfs-3.8.1-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12243-1 medium	libsndfile-devel-1.2.2-7.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12244-1 medium	libtirpc-devel-1.3.8-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12245-1 medium	libmariadbd-devel-12.3.2-3.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12246-1 medium	mihomo-1.19.33-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12247-1 medium	nano-9.3-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12248-1 medium	corepack24-24.22.1-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12249-1 medium	libopenscap33-1.4.6-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12250-1 medium	perl-Mozilla-CA-20261020.0.0-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12251-1 medium	python313-Pillow-13.0.0-2.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12252-1 medium	libruby4_0-4_0-4.0.9-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12254-1 medium	tomcat-9.0.123-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12257-1 medium	libunbound8-1.26.2-1.1 on GA media	24 Oct 202619:09 UTC build
CVE-2026-76654 medium	kubelet: kubelet: Subpath symlinking on Windows nodes permits NTLM coercion	since at least 24 Oct 202607:11 UTC build	26 Oct 2026
CVE-2026-2270 medium	kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation	since at least 24 Oct 202607:11 UTC build	26 Oct 2026
CVE-2026-115897 medium	serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115892 medium	wasmtime: Wasmtime: Denial of Service via missing payload type validation in guest returns	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115886 medium	mlflow: mlflow: Server-Side Request Forgery via insecure scorer deserialization	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115883 medium	LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-8c8m-p3m8-cjg8 medium	Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-m943-m63m-w62w medium	Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-85x2-q946-cp5h medium	Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-7xgj-8392-5q4r medium	FastMCP: Post-transform component authorization is skipped on direct calls	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-vqqp-x5qm-5qp4 medium	FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115877 medium	twisted: Twisted: HTTP request smuggling via improper header delimiter handling	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115774 medium	twisted: twisted: Denial of Service via negative size in IMAP search command	since at least 24 Oct 202607:11 UTC build	23 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.