There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or
    deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls
    back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for
    a request to a different, trusted origin whenever the method, path, and relevant headers match, which
    permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a
    full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging
    to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0
    and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the
    origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2. (CVE-2026-85152)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of
    Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a
    Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from
    hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so
    an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute
    script under the application's origin. (CVE-2026-93981)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's
    PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature
    is false. If an application reuses that same mapping for a later decode() or decode_complete() call and
    changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-
    at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then
    be accepted without disabling signature verification, but applications that create a fresh options mapping
    for each call are not affected. (CVE-2026-103001)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is
    affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like
    input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs
    unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive
    CPU consumption. This issue is fixed in version 2.14.0. (CVE-2026-102270)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel()
    accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without
    checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256
    verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different
    wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the
    attacker-controlled wheel into subsequently created environments. The verification applies to the default
    PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a
    custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
    (CVE-2026-102930)

ID	Name	Severity
465530	Chainguard: homepage: security update to 2.4.0-r1	high
465528	Chainguard: librechat: security update to 0.8.7-r16	low
465505	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	medium
465503	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	medium
465500	Chainguard: mlflow-iamguarded-compat: security update to 3.16.1-r1	high

Detections

Analytics

Chainguard Local Security Checks Family for Tenable Cloud Security

high

low

medium

medium

high