bvandeusen/FabledScribe
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 53 Wiki Activity

Security Dashboard #108

New Issue
Open
opened 2026-08-09 20:58:29 -04:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-09 20:58:29 -04:00
Collaborator
Copy Link
Copy Source

Automated weekly security sweep — last rewritten 2026-08-31 07:31 UTC (runs).

This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them with a written reason (this repo's .gitleaks.toml for secrets, an inline # nosemgrep: <rule-id> -- <reason> for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface.

Secrets (gitleaks)

Clean — no findings.

Code findings (semgrep, curated family ruleset)

ERROR — believed-real on this family's code (2):

  • alembic/versions/0053_drop_chat_journal_push_curator_tables.py:65 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0089_rule_embeddings.py:44 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
    WARNING — useful, precision not yet proven (12):
  • frontend/src/components/InlineAssistPanel.vue:40 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/InlineAssistPanel.vue:71 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/NoteCard.vue:44 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/TaskLogSection.vue:134 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/WorkspaceTaskPanel.vue:320 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/GraphView.vue:562 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteEditorView.vue:418 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteEditorView.vue:442 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteViewerView.vue:262 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/ProjectView.vue:1020 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/TaskEditorView.vue:515 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/TaskEditorView.vue:540 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i

Dependency CVEs (osv-scanner)

Published image (trivy)

  • HIGH CVE-2026-41992 — gzip 1.13-1 (no fix released)
  • HIGH CVE-2026-54369 — libacl1 2.3.2-2+b1 (no fix released)
  • HIGH CVE-2025-69720 — libncursesw6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-11822 — libsqlite3-0 3.46.1-7+deb13u1 (no fix released)
  • HIGH CVE-2026-11824 — libsqlite3-0 3.46.1-7+deb13u1 (no fix released)
  • HIGH CVE-2026-14456 — libssl3t64 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • HIGH CVE-2025-69720 — libtinfo6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-base 6.5+20250216-2 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-bin 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-14456 — openssl 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • HIGH CVE-2026-14456 — openssl-provider-legacy 3.5.6-1~deb13u2 → fixed in 3.5.7-1~deb13u2
  • CRITICAL CVE-2026-13221 — perl-base 5.40.1-6 (no fix released)
  • CRITICAL CVE-2026-42496 — perl-base 5.40.1-6 (no fix released)
  • CRITICAL CVE-2026-8376 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-42497 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-48962 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-57432 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-57433 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-9538 — perl-base 5.40.1-6 (no fix released)
  • HIGH CVE-2026-41205 — Mako 1.3.10 → fixed in 1.3.11
  • HIGH CVE-2026-44307 — Mako 1.3.10 → fixed in 1.3.12
  • HIGH CVE-2026-69247 — cryptography 46.0.7 → fixed in 50.0.0
  • HIGH CVE-2026-69249 — cryptography 46.0.7 → fixed in 49.0.0
  • HIGH GHSA-537c-gmf6-5ccf — cryptography 46.0.7 → fixed in 48.0.1
  • HIGH CVE-2026-41066 — lxml 6.0.3 → fixed in 6.1.0
  • HIGH CVE-2026-59950 — mcp 1.27.2 → fixed in 1.28.1
  • HIGH GHSA-6v7p-g79w-8964 — msgpack 1.1.2 → fixed in 1.2.1
  • HIGH CVE-2026-54058 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-54059 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-54060 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-55379 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-55380 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-59197 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-59199 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-59200 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-59204 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-59205 — pillow 12.2.0 → fixed in 12.3.0
  • HIGH CVE-2026-53539 — python-multipart 0.0.29 → fixed in 0.0.30
  • HIGH CVE-2025-47273 — setuptools 70.3.0 → fixed in 78.1.1
  • HIGH CVE-2026-54283 — starlette 1.2.0 → fixed in 1.3.1
    …and 3 more line(s) truncated — run the scanner locally or trigger the sweep with only= for the full list.

Coverage & limits

  • All four scanners ran with nothing skipped.
<!-- fabledsentry-security-dashboard --> _Automated weekly security sweep — last rewritten 2026-08-31 07:31 UTC ([runs](https://git.fabledsword.com/bvandeusen/CI-runner/actions))._ This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them **with a written reason** (this repo's `.gitleaks.toml` for secrets, an inline `# nosemgrep: <rule-id> -- <reason>` for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface. ## Secrets (gitleaks) Clean — no findings. ## Code findings (semgrep, curated family ruleset) **ERROR — believed-real on this family's code (2):** - `alembic/versions/0053_drop_chat_journal_push_curator_tables.py:65` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0089_rule_embeddings.py:44` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. **WARNING — useful, precision not yet proven (12):** - `frontend/src/components/InlineAssistPanel.vue:40` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/InlineAssistPanel.vue:71` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/NoteCard.vue:44` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/TaskLogSection.vue:134` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/WorkspaceTaskPanel.vue:320` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/GraphView.vue:562` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteEditorView.vue:418` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteEditorView.vue:442` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteViewerView.vue:262` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/ProjectView.vue:1020` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/TaskEditorView.vue:515` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/TaskEditorView.vue:540` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i ## Dependency CVEs (osv-scanner) - `@protobufjs/utf8 1.1.0` (npm, `frontend/package-lock.json`): [GHSA-q6x5-8v7m-xcrf](https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf) - `dompurify 3.3.2` (npm, `frontend/package-lock.json`): [GHSA-39q2-94rc-95cp](https://osv.dev/vulnerability/GHSA-39q2-94rc-95cp), [GHSA-55q2-fjhq-7xh7](https://osv.dev/vulnerability/GHSA-55q2-fjhq-7xh7), [GHSA-76mc-f452-cxcm](https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm), [GHSA-c2j3-45gr-mqc4](https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4), [GHSA-cmwh-pvxp-8882](https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882), [GHSA-crv5-9vww-q3g8](https://osv.dev/vulnerability/GHSA-crv5-9vww-q3g8), [GHSA-gvmj-g25r-r7wr](https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr), [GHSA-h7mw-gpvr-xq4m](https://osv.dev/vulnerability/GHSA-h7mw-gpvr-xq4m), [GHSA-hpcv-96wg-7vj8](https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8), [GHSA-r47g-fvhr-h676](https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676), [GHSA-rp9w-3fw7-7cwq](https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq), [GHSA-v9jr-rg53-9pgp](https://osv.dev/vulnerability/GHSA-v9jr-rg53-9pgp), [GHSA-vxr8-fq34-vvx9](https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9), [GHSA-x4vx-rjvf-j5p4](https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4) - `esbuild 0.27.3` (npm, `frontend/package-lock.json`): [GHSA-g7r4-m6w7-qqqr](https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr) - `linkify-it 5.0.0` (npm, `frontend/package-lock.json`): [GHSA-22p9-wv53-3rq4](https://osv.dev/vulnerability/GHSA-22p9-wv53-3rq4), [GHSA-v245-v573-v5vm](https://osv.dev/vulnerability/GHSA-v245-v573-v5vm) - `markdown-it 14.1.1` (npm, `frontend/package-lock.json`): [GHSA-6v5v-wf23-fmfq](https://osv.dev/vulnerability/GHSA-6v5v-wf23-fmfq) - `nanoid 3.3.11` (npm, `frontend/package-lock.json`): [GHSA-28wg-ghj8-5hjv](https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv), [GHSA-2v37-7h3g-55p8](https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8) - `picomatch 4.0.3` (npm, `frontend/package-lock.json`): [GHSA-3v7f-55p6-f55p](https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p), [GHSA-c2c7-rcm5-vvqj](https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj) - `postcss 8.5.8` (npm, `frontend/package-lock.json`): [GHSA-6g55-p6wh-862q](https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q), [GHSA-fxqj-rqcc-2cmp](https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp), [GHSA-qx2v-qp2m-jg93](https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93), [GHSA-r28c-9q8g-f849](https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849) - `protobufjs 7.5.5` (npm, `frontend/package-lock.json`): [GHSA-2pr8-phx7-x9h3](https://osv.dev/vulnerability/GHSA-2pr8-phx7-x9h3), [GHSA-66ff-xgx4-vchm](https://osv.dev/vulnerability/GHSA-66ff-xgx4-vchm), [GHSA-685m-2w69-288q](https://osv.dev/vulnerability/GHSA-685m-2w69-288q), [GHSA-75px-5xx7-5xc7](https://osv.dev/vulnerability/GHSA-75px-5xx7-5xc7), [GHSA-f38q-mgvj-vph7](https://osv.dev/vulnerability/GHSA-f38q-mgvj-vph7), [GHSA-fx83-v9x8-x52w](https://osv.dev/vulnerability/GHSA-fx83-v9x8-x52w), [GHSA-j3f2-48v5-ccww](https://osv.dev/vulnerability/GHSA-j3f2-48v5-ccww), [GHSA-jggg-4jg4-v7c6](https://osv.dev/vulnerability/GHSA-jggg-4jg4-v7c6), [GHSA-jvwf-75h9-cwgg](https://osv.dev/vulnerability/GHSA-jvwf-75h9-cwgg), [GHSA-q6x5-8v7m-xcrf](https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf), [GHSA-wcpc-wj8m-hjx6](https://osv.dev/vulnerability/GHSA-wcpc-wj8m-hjx6) - `vite 7.3.1` (npm, `frontend/package-lock.json`): [GHSA-4w7w-66w2-5vf9](https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9), [GHSA-fx2h-pf6j-xcff](https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff), [GHSA-p9ff-h696-f583](https://osv.dev/vulnerability/GHSA-p9ff-h696-f583), [GHSA-v2wj-q39q-566r](https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r), [GHSA-v6wh-96g9-6wx3](https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3) - `yaml 2.8.2` (npm, `frontend/package-lock.json`): [GHSA-48c2-rrv3-qjmp](https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp) - `aiosmtplib 5.1.0` (PyPI, `uv.lock`): [GHSA-v3q9-hj7j-63hq](https://osv.dev/vulnerability/GHSA-v3q9-hj7j-63hq), [GHSA-vxj7-4xrp-5vr4](https://osv.dev/vulnerability/GHSA-vxj7-4xrp-5vr4), [PYSEC-2026-2338](https://osv.dev/vulnerability/PYSEC-2026-2338) - `click 8.3.2` (PyPI, `uv.lock`): [PYSEC-2026-2132](https://osv.dev/vulnerability/PYSEC-2026-2132) - `cryptography 46.0.7` (PyPI, `uv.lock`): [GHSA-537c-gmf6-5ccf](https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf), [GHSA-g6cj-pr64-35w5](https://osv.dev/vulnerability/GHSA-g6cj-pr64-35w5), [GHSA-jwv3-5hgf-82ww](https://osv.dev/vulnerability/GHSA-jwv3-5hgf-82ww), [GHSA-m2h6-j472-rp4c](https://osv.dev/vulnerability/GHSA-m2h6-j472-rp4c), [PYSEC-2026-3552](https://osv.dev/vulnerability/PYSEC-2026-3552), [PYSEC-2026-3553](https://osv.dev/vulnerability/PYSEC-2026-3553), [PYSEC-2026-3554](https://osv.dev/vulnerability/PYSEC-2026-3554) - `h2 4.3.0` (PyPI, `uv.lock`): [GHSA-6hr6-w5qg-qmwg](https://osv.dev/vulnerability/GHSA-6hr6-w5qg-qmwg), [PYSEC-2026-3628](https://osv.dev/vulnerability/PYSEC-2026-3628) - `idna 3.11` (PyPI, `uv.lock`): [GHSA-65pc-fj4g-8rjx](https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx), [PYSEC-2026-215](https://osv.dev/vulnerability/PYSEC-2026-215) - `lxml 6.0.3` (PyPI, `uv.lock`): [GHSA-vfmq-68hx-4jfw](https://osv.dev/vulnerability/GHSA-vfmq-68hx-4jfw), [PYSEC-2026-87](https://osv.dev/vulnerability/PYSEC-2026-87) - `mako 1.3.10` (PyPI, `uv.lock`): [GHSA-2h4p-vjrc-8xpq](https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq), [GHSA-v92g-xgxw-vvmm](https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm), [PYSEC-2026-2617](https://osv.dev/vulnerability/PYSEC-2026-2617), [PYSEC-2026-88](https://osv.dev/vulnerability/PYSEC-2026-88) - `mcp 1.27.2` (PyPI, `uv.lock`): [GHSA-vj7q-gjh5-988w](https://osv.dev/vulnerability/GHSA-vj7q-gjh5-988w), [PYSEC-2026-3483](https://osv.dev/vulnerability/PYSEC-2026-3483) - `pillow 12.2.0` (PyPI, `uv.lock`): [GHSA-45hq-cxwh-f6vc](https://osv.dev/vulnerability/GHSA-45hq-cxwh-f6vc), [GHSA-4x4j-2g7c-83w6](https://osv.dev/vulnerability/GHSA-4x4j-2g7c-83w6), [GHSA-5x94-69rx-g8h2](https://osv.dev/vulnerability/GHSA-5x94-69rx-g8h2), [GHSA-62p4-gmf7-7g93](https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93), [GHSA-6r8x-57c9-28j4](https://osv.dev/vulnerability/GHSA-6r8x-57c9-28j4), [GHSA-8v84-f9pq-wr9x](https://osv.dev/vulnerability/GHSA-8v84-f9pq-wr9x), [GHSA-9hw9-ch79-4vh6](https://osv.dev/vulnerability/GHSA-9hw9-ch79-4vh6), [GHSA-fj7v-r99m-22gq](https://osv.dev/vulnerability/GHSA-fj7v-r99m-22gq), [GHSA-jjj6-mw9f-p565](https://osv.dev/vulnerability/GHSA-jjj6-mw9f-p565), [GHSA-pg7v-jwj7-p798](https://osv.dev/vulnerability/GHSA-pg7v-jwj7-p798), [GHSA-phj9-mv4w-65pm](https://osv.dev/vulnerability/GHSA-phj9-mv4w-65pm), [GHSA-vjc4-5qp5-m44j](https://osv.dev/vulnerability/GHSA-vjc4-5qp5-m44j), [GHSA-xj96-63gp-2gmr](https://osv.dev/vulnerability/GHSA-xj96-63gp-2gmr), [PYSEC-2026-2253](https://osv.dev/vulnerability/PYSEC-2026-2253), [PYSEC-2026-2254](https://osv.dev/vulnerability/PYSEC-2026-2254), [PYSEC-2026-2255](https://osv.dev/vulnerability/PYSEC-2026-2255), [PYSEC-2026-2256](https://osv.dev/vulnerability/PYSEC-2026-2256), [PYSEC-2026-2257](https://osv.dev/vulnerability/PYSEC-2026-2257), [PYSEC-2026-3451](https://osv.dev/vulnerability/PYSEC-2026-3451), [PYSEC-2026-3452](https://osv.dev/vulnerability/PYSEC-2026-3452), [PYSEC-2026-3453](https://osv.dev/vulnerability/PYSEC-2026-3453), [PYSEC-2026-3454](https://osv.dev/vulnerability/PYSEC-2026-3454), [PYSEC-2026-3493](https://osv.dev/vulnerability/PYSEC-2026-3493), [PYSEC-2026-3494](https://osv.dev/vulnerability/PYSEC-2026-3494), [PYSEC-2026-3495](https://osv.dev/vulnerability/PYSEC-2026-3495), [PYSEC-2026-3496](https://osv.dev/vulnerability/PYSEC-2026-3496) - `pydantic-settings 2.14.1` (PyPI, `uv.lock`): [GHSA-4xgf-cpjx-pc3j](https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j) - `python-multipart 0.0.29` (PyPI, `uv.lock`): [GHSA-5rvq-cxj2-64vf](https://osv.dev/vulnerability/GHSA-5rvq-cxj2-64vf), [GHSA-6jv3-5f52-599m](https://osv.dev/vulnerability/GHSA-6jv3-5f52-599m), [GHSA-v9pg-7xvm-68hf](https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf), [GHSA-vffw-93wf-4j4q](https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q), [PYSEC-2026-3036](https://osv.dev/vulnerability/PYSEC-2026-3036), [PYSEC-2026-3037](https://osv.dev/vulnerability/PYSEC-2026-3037), [PYSEC-2026-3040](https://osv.dev/vulnerability/PYSEC-2026-3040), [PYSEC-2026-3041](https://osv.dev/vulnerability/PYSEC-2026-3041) - `starlette 1.2.0` (PyPI, `uv.lock`): [GHSA-82w8-qh3p-5jfq](https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq), [GHSA-jp82-jpqv-5vv3](https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3), [PYSEC-2026-248](https://osv.dev/vulnerability/PYSEC-2026-248), [PYSEC-2026-249](https://osv.dev/vulnerability/PYSEC-2026-249) - `urllib3 2.6.3` (PyPI, `uv.lock`): [GHSA-mf9v-mfxr-j63j](https://osv.dev/vulnerability/GHSA-mf9v-mfxr-j63j), [GHSA-qccp-gfcp-xxvc](https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc), [PYSEC-2026-141](https://osv.dev/vulnerability/PYSEC-2026-141), [PYSEC-2026-142](https://osv.dev/vulnerability/PYSEC-2026-142) ## Published image (trivy) - **HIGH** CVE-2026-41992 — `gzip 1.13-1` (no fix released) - **HIGH** CVE-2026-54369 — `libacl1 2.3.2-2+b1` (no fix released) - **HIGH** CVE-2025-69720 — `libncursesw6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-11822 — `libsqlite3-0 3.46.1-7+deb13u1` (no fix released) - **HIGH** CVE-2026-11824 — `libsqlite3-0 3.46.1-7+deb13u1` (no fix released) - **HIGH** CVE-2026-14456 — `libssl3t64 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **HIGH** CVE-2025-69720 — `libtinfo6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-base 6.5+20250216-2` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-bin 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-14456 — `openssl 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **HIGH** CVE-2026-14456 — `openssl-provider-legacy 3.5.6-1~deb13u2` → fixed in 3.5.7-1~deb13u2 - **CRITICAL** CVE-2026-13221 — `perl-base 5.40.1-6` (no fix released) - **CRITICAL** CVE-2026-42496 — `perl-base 5.40.1-6` (no fix released) - **CRITICAL** CVE-2026-8376 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-42497 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-48962 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-57432 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-57433 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-9538 — `perl-base 5.40.1-6` (no fix released) - **HIGH** CVE-2026-41205 — `Mako 1.3.10` → fixed in 1.3.11 - **HIGH** CVE-2026-44307 — `Mako 1.3.10` → fixed in 1.3.12 - **HIGH** CVE-2026-69247 — `cryptography 46.0.7` → fixed in 50.0.0 - **HIGH** CVE-2026-69249 — `cryptography 46.0.7` → fixed in 49.0.0 - **HIGH** GHSA-537c-gmf6-5ccf — `cryptography 46.0.7` → fixed in 48.0.1 - **HIGH** CVE-2026-41066 — `lxml 6.0.3` → fixed in 6.1.0 - **HIGH** CVE-2026-59950 — `mcp 1.27.2` → fixed in 1.28.1 - **HIGH** GHSA-6v7p-g79w-8964 — `msgpack 1.1.2` → fixed in 1.2.1 - **HIGH** CVE-2026-54058 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-54059 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-54060 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-55379 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-55380 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-59197 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-59199 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-59200 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-59204 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-59205 — `pillow 12.2.0` → fixed in 12.3.0 - **HIGH** CVE-2026-53539 — `python-multipart 0.0.29` → fixed in 0.0.30 - **HIGH** CVE-2025-47273 — `setuptools 70.3.0` → fixed in 78.1.1 - **HIGH** CVE-2026-54283 — `starlette 1.2.0` → fixed in 1.3.1 _…and 3 more line(s) truncated — run the scanner locally or trigger the sweep with `only=` for the full list._ ## Coverage & limits - All four scanners ran with nothing skipped.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot bvandeusen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bvandeusen/FabledScribe#108