{"schemaVersion":3,"id":"CVE-2026-102991","aliases":["GHSA-5639-2j2p-m4mx","UBUNTU-CVE-2026-102991","CGA-f5q9-28w2-3r7p","CGA-x364-jggg-m5xp","CGA-2229-5wfc-2c8w","CGA-225r-4c4p-xf6h","CGA-2672-gvv7-6hrr","CGA-2cvw-c465-rcf9","CGA-2g45-7q29-7jmx","CGA-2r6f-qw6r-w22r","CGA-33x3-jxr3-6qr3","CGA-3jwh-q2p8-mhh6","CGA-3qhx-mv85-m56q","CGA-43q8-6xq2-mxx3","CGA-4cw6-f2qp-hv76","CGA-4f3x-mgj7-43v3","CGA-4fm3-m2pq-vgv3","CGA-4q8h-g847-cjc8","CGA-52cp-cj5v-xcw5","CGA-52vm-wc8h-8xq9","CGA-54f4-cfmg-h24p","CGA-54rg-3gxx-wqhv","CGA-5639-6wjp-49jv","CGA-5p86-m3c8-wrx9","CGA-5x58-frfx-vw3p","CGA-5x7v-chc7-px92","CGA-648h-xq8p-3582","CGA-652w-f7m3-v7c5","CGA-678p-7m73-v4hj","CGA-6ccf-px87-6fj4","CGA-6m9w-mw2r-fgfv","CGA-6mgj-whfh-f4pj","CGA-6qr9-mx7h-cqv6","CGA-6w59-r4v8-9696","CGA-6xfg-63m8-vgg7","CGA-765c-wmgp-g53g","CGA-76p7-6qch-qhrf","CGA-7jpv-5fcx-fcvv","CGA-7v2f-47j9-qgv8","CGA-7w57-qrc7-9x6f","CGA-7xpp-q3fx-gpvf","CGA-8c85-f2wf-gqqp","CGA-8gpx-hghr-6x8r","CGA-8hc3-5fx6-5m66","CGA-8pjq-5m6v-rjrv","CGA-8vmw-mg87-g25m","CGA-99rj-mxgw-j9c7","CGA-9mx3-jc9r-5xmc","CGA-9pjx-468f-j4c5","CGA-c274-4g36-jv7c","CGA-cc62-j476-j9qc","CGA-cfgg-whmp-7cgr","CGA-cfj5-rw69-fxj2","CGA-f5jq-7mx8-hcv7","CGA-f6w2-9vj5-gvhh","CGA-f852-x6g3-9rrc","CGA-fpw9-h3x5-fmmf","CGA-fr87-qgqf-74w9","CGA-fvv3-j2xc-cqv8","CGA-gfqh-mw9h-vpcw","CGA-gg2j-x8h7-m24g","CGA-gj4j-83mf-8fxq","CGA-gm97-wphg-98mm","CGA-grwx-hh3f-frm7","CGA-gwwr-gvvf-c52r","CGA-h37f-4rcr-68q7","CGA-h3r8-4gjc-xjx7","CGA-h8wp-gg65-w6hq","CGA-h978-v5g7-33x2","CGA-hg76-jmfv-q9xj","CGA-hrhj-pc8v-g45x","CGA-hvp8-gj8c-h4v5","CGA-hw9f-6f64-c4w2","CGA-j5f6-6wjj-jwc2","CGA-jg7c-rh84-5cm5","CGA-jgh3-5fx5-755h","CGA-jx9f-rphg-65wc","CGA-mcvr-9q79-gm9x","CGA-mj39-8mfr-vvp4","CGA-mj72-5j6p-pp5x","CGA-mw5w-q9p9-pq29","CGA-p362-9xm9-jwpr","CGA-pc53-q7cc-hmgr","CGA-phg6-fv3j-gwjw","CGA-ppfp-3wxc-vwgv","CGA-pwxv-673m-6fc9","CGA-rx6g-5wj5-g2j8","CGA-px25-4qw8-9mv7","CGA-pxjr-c34v-qwch","CGA-q36v-2m8w-7q5w","CGA-q4h9-6hgp-jf94","CGA-q8cx-2xqj-64wr","CGA-qcgv-68x6-ww3g","CGA-qcrj-5x4q-9vg6","CGA-qg7x-v4r4-gfm7","CGA-qjw6-j2mh-wghh","CGA-qm5h-x324-pwx3","CGA-qw2g-6cgw-v9j4","CGA-rmgf-f4pr-qp9m","CGA-rw53-4ccv-635f","CGA-v3r9-9rxc-6597","CGA-v7r7-xgqv-743r","CGA-v8qq-3pfm-jj25","CGA-v9hj-62r9-f2xq","CGA-vcr5-hh77-hvf2","CGA-vf6v-822p-6mqh","CGA-vp37-rc3m-8r84","CGA-vpfx-wpmh-xx78","CGA-vwwq-f95c-96ff","CGA-wcqx-qjg8-qff6","CGA-wr5h-7chx-j529","CGA-wxhm-p63w-5gcf","CGA-x3g3-5j7r-jm37","CGA-xcrq-q7x2-hhjj","CGA-xfwh-xrgr-7hhr","CGA-xghq-rgxg-6r5p","CGA-xpcx-phrx-vf68","PYSEC-2026-4243"],"status":"published","duplicateOf":null,"title":null,"description":"Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.","dates":{"published":"2026-09-30T19:47:07.128Z","modified":"2026-09-30T19:54:41.077Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":5.6,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":5.6,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":5.6,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":5.6,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00356,"percentile":0.28004,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-01T00:00:00.000Z","score":0.00411,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00356,"percentile":0.28004}],"last30":[{"date":"2026-10-01T00:00:00.000Z","score":0.00411,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00356,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00356,"percentile":0.28004}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"airflow-2","name":"airflow-2","label":"airflow-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-core-2","name":"airflow-core-2","label":"airflow-core-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-core-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jupyterhub-k8s-singleuser-sample","name":"jupyterhub-k8s-singleuser-sample","label":"jupyterhub-k8s-singleuser-sample","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jupyterhub-k8s-singleuser-sample","purlType":"apk","versions":[{"text":"< 4.4.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.4.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlflow-fips","name":"mlflow-fips","label":"mlflow-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlflow-fips","purlType":"apk","versions":[{"text":"< 3.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.16.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0","name":"nemo-rl-cuda-13.0","label":"nemo-rl-cuda-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-automodel","name":"nemo-rl-cuda-13.0-automodel","label":"nemo-rl-cuda-13.0-automodel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-automodel","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-mcore","name":"nemo-rl-cuda-13.0-mcore","label":"nemo-rl-cuda-13.0-mcore","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-mcore","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-sglang","name":"nemo-rl-cuda-13.0-sglang","label":"nemo-rl-cuda-13.0-sglang","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-sglang","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-vllm","name":"nemo-rl-cuda-13.0-vllm","label":"nemo-rl-cuda-13.0-vllm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-vllm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-barbican-2025.2","name":"openstack-barbican-2025.2","label":"openstack-barbican-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-barbican-2025.2","purlType":"apk","versions":[{"text":"< 21.0.0_git20260928-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.0_git20260928-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-barbican-2026.1","name":"openstack-barbican-2026.1","label":"openstack-barbican-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-barbican-2026.1","purlType":"apk","versions":[{"text":"< 22.0.0_git20260928-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.0_git20260928-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-cinder-2026.1","name":"openstack-cinder-2026.1","label":"openstack-cinder-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-cinder-2026.1","purlType":"apk","versions":[{"text":"< 28.0.0_git20260904-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.0_git20260904-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-designate-2025.2","name":"openstack-designate-2025.2","label":"openstack-designate-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-designate-2025.2","purlType":"apk","versions":[{"text":"< 21.0.1_git20260817-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.1_git20260817-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-designate-2026.1","name":"openstack-designate-2026.1","label":"openstack-designate-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-designate-2026.1","purlType":"apk","versions":[{"text":"< 22.0.1_git20260827-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.1_git20260827-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.1","name":"openstack-glance-2025.1","label":"openstack-glance-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.1","purlType":"apk","versions":[{"text":"< 30.2.0_git20260912-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 30.2.0_git20260912-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.1-fips","name":"openstack-glance-2025.1-fips","label":"openstack-glance-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.1-fips","purlType":"apk","versions":[{"text":"< 30.2.0_git20260928-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 30.2.0_git20260928-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.2","name":"openstack-glance-2025.2","label":"openstack-glance-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.2","purlType":"apk","versions":[{"text":"< 31.1.0_git20260925-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.1.0_git20260925-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2025.2-fips","name":"openstack-glance-2025.2-fips","label":"openstack-glance-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2025.2-fips","purlType":"apk","versions":[{"text":"< 31.1.0_git20260925-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.1.0_git20260925-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2026.1","name":"openstack-glance-2026.1","label":"openstack-glance-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2026.1","purlType":"apk","versions":[{"text":"< 32.0.0_git20260930-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.0_git20260930-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-glance-2026.1-fips","name":"openstack-glance-2026.1-fips","label":"openstack-glance-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-glance-2026.1-fips","purlType":"apk","versions":[{"text":"< 32.0.0_git20260930-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.0_git20260930-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-heat-2025.2","name":"openstack-heat-2025.2","label":"openstack-heat-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-heat-2025.2","purlType":"apk","versions":[{"text":"< 25.0.1_git20260905-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.1_git20260905-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-heat-2026.1","name":"openstack-heat-2026.1","label":"openstack-heat-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-heat-2026.1","purlType":"apk","versions":[{"text":"< 26.0.1_git20260905-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.0.1_git20260905-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.1","name":"openstack-horizon-2025.1","label":"openstack-horizon-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.1","purlType":"apk","versions":[{"text":"< 25.3.2_git20260617-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.3.2_git20260617-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.1-fips","name":"openstack-horizon-2025.1-fips","label":"openstack-horizon-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.1-fips","purlType":"apk","versions":[{"text":"< 25.3.2_git20260617-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.3.2_git20260617-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.2","name":"openstack-horizon-2025.2","label":"openstack-horizon-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.2","purlType":"apk","versions":[{"text":"< 25.5.2_git20260914-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.5.2_git20260914-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2025.2-fips","name":"openstack-horizon-2025.2-fips","label":"openstack-horizon-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2025.2-fips","purlType":"apk","versions":[{"text":"< 25.5.2_git20260914-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.5.2_git20260914-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2026.1","name":"openstack-horizon-2026.1","label":"openstack-horizon-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2026.1","purlType":"apk","versions":[{"text":"< 25.7.3_git20260924-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.7.3_git20260924-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-horizon-2026.1-fips","name":"openstack-horizon-2026.1-fips","label":"openstack-horizon-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-horizon-2026.1-fips","purlType":"apk","versions":[{"text":"< 25.7.3_git20261001-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.7.3_git20261001-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1","name":"openstack-keystone-2025.1","label":"openstack-keystone-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1","purlType":"apk","versions":[{"text":"< 27.0.1_git20260910-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 27.0.1_git20260910-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260910-r6 | < 27.0.1_git20260910-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1-fips","name":"openstack-keystone-2025.1-fips","label":"openstack-keystone-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1-fips","purlType":"apk","versions":[{"text":"< 27.0.1_git20260910-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260910-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.2","name":"openstack-keystone-2025.2","label":"openstack-keystone-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.2","purlType":"apk","versions":[{"text":"< 28.0.1_git20260902-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.1_git20260902-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2026.1","name":"openstack-keystone-2026.1","label":"openstack-keystone-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2026.1","purlType":"apk","versions":[{"text":"< 29.0.1_git20260904-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 29.0.1_git20260904-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-manila-2025.2","name":"openstack-manila-2025.2","label":"openstack-manila-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-manila-2025.2","purlType":"apk","versions":[{"text":"< 21.0.2_git20260923-r5","noFixRecorded":false,"fixedIn":null},{"text":"< 21.0.2_git20260923-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.2_git20260923-r5 | < 21.0.2_git20260923-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-manila-2026.1","name":"openstack-manila-2026.1","label":"openstack-manila-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-manila-2026.1","purlType":"apk","versions":[{"text":"< 22.0.1_git20260905-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 22.0.1_git20260905-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.1_git20260905-r6 | < 22.0.1_git20260905-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-neutron-2026.1","name":"openstack-neutron-2026.1","label":"openstack-neutron-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-neutron-2026.1","purlType":"apk","versions":[{"text":"< 28.0.2_git20260928-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.2_git20260928-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-nova-2025.1","name":"openstack-nova-2025.1","label":"openstack-nova-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-nova-2025.1","purlType":"apk","versions":[{"text":"< 31.3.0_git20260717-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.3.0_git20260717-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-nova-2025.2","name":"openstack-nova-2025.2","label":"openstack-nova-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-nova-2025.2","purlType":"apk","versions":[{"text":"< 32.2.0_git20260715-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.2.0_git20260715-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-nova-2026.1","name":"openstack-nova-2026.1","label":"openstack-nova-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-nova-2026.1","purlType":"apk","versions":[{"text":"< 33.0.1_git20260819-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.1_git20260819-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-octavia-2025.2","name":"openstack-octavia-2025.2","label":"openstack-octavia-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-octavia-2025.2","purlType":"apk","versions":[{"text":"< 17.0.1_git20260904-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.0.1_git20260904-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-octavia-2026.1","name":"openstack-octavia-2026.1","label":"openstack-octavia-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-octavia-2026.1","purlType":"apk","versions":[{"text":"< 18.0.1_git20260904-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 18.0.1_git20260904-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.0.1_git20260904-r4 | < 18.0.1_git20260904-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.1","name":"openstack-placement-2025.1","label":"openstack-placement-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.1","purlType":"apk","versions":[{"text":"< 13.0.0_git20260916-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0_git20260916-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.1-fips","name":"openstack-placement-2025.1-fips","label":"openstack-placement-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.1-fips","purlType":"apk","versions":[{"text":"< 13.0.0_git20260916-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0_git20260916-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.2","name":"openstack-placement-2025.2","label":"openstack-placement-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.2","purlType":"apk","versions":[{"text":"< 14.0.0_git20260916-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.0.0_git20260916-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2025.2-fips","name":"openstack-placement-2025.2-fips","label":"openstack-placement-2025.2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2025.2-fips","purlType":"apk","versions":[{"text":"< 14.0.0_git20260916-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.0.0_git20260916-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2026.1","name":"openstack-placement-2026.1","label":"openstack-placement-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2026.1","purlType":"apk","versions":[{"text":"< 15.0.0_git20260806-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.0.0_git20260806-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-placement-2026.1-fips","name":"openstack-placement-2026.1-fips","label":"openstack-placement-2026.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-placement-2026.1-fips","purlType":"apk","versions":[{"text":"< 15.0.0_git20260812-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.0.0_git20260812-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-tempest-2025.1","name":"openstack-tempest-2025.1","label":"openstack-tempest-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-tempest-2025.1","purlType":"apk","versions":[{"text":"< 43.0.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.0.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-tempest-2025.2","name":"openstack-tempest-2025.2","label":"openstack-tempest-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-tempest-2025.2","purlType":"apk","versions":[{"text":"< 45.0.0-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 45.0.0-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-tempest-2026.1","name":"openstack-tempest-2026.1","label":"openstack-tempest-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-tempest-2026.1","purlType":"apk","versions":[{"text":"< 46.2.0-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 46.2.0-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-airflow-3","name":"py3.12-airflow-3","label":"py3.12-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-airflow-core-3","name":"py3.12-airflow-core-3","label":"py3.12-airflow-core-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-airflow-core-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-airflow-postgres-fips-3","name":"py3.12-airflow-postgres-fips-3","label":"py3.12-airflow-postgres-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-airflow-postgres-fips-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-airflow-3","name":"py3.13-airflow-3","label":"py3.13-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-airflow-core-3","name":"py3.13-airflow-core-3","label":"py3.13-airflow-core-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-airflow-core-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-airflow-postgres-fips-3","name":"py3.13-airflow-postgres-fips-3","label":"py3.13-airflow-postgres-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-airflow-postgres-fips-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.14-airflow-3","name":"py3.14-airflow-3","label":"py3.14-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.14-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.14-airflow-core-3","name":"py3.14-airflow-core-3","label":"py3.14-airflow-core-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.14-airflow-core-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.14-airflow-postgres-fips-3","name":"py3.14-airflow-postgres-fips-3","label":"py3.14-airflow-postgres-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.14-airflow-postgres-fips-3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.3.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.3.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"reflex","name":"reflex","label":"reflex","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/reflex","purlType":"apk","versions":[{"text":"< 0.9.12-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.12-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"superset-5.0","name":"superset-5.0","label":"superset-5.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/superset-5.0","purlType":"apk","versions":[{"text":"< 5.0.0-r42","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.0-r42","eol":null,"hubHref":null},{"vendor":"wolfi","product":"reflex","name":"reflex","label":"reflex","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/reflex","purlType":"apk","versions":[{"text":"< 0.9.12-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.12-r1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mako","name":"mako","label":"mako","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mako","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"PyPI","product":"mako","name":"mako","label":"mako","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/mako","purlType":"pypi","versions":[{"text":"< 1.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2","eol":null,"hubHref":null},{"vendor":"sqlalchemy","product":"mako","name":"mako","label":"mako","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2","eol":null,"hubHref":"/vendor/sqlalchemy/mako"}],"affectedCount":65,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx","label":"github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","REPORT","Advisory"]},{"url":"https://github.com/sqlalchemy/mako/issues/441","label":"github.com/sqlalchemy/mako/issues/441","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT"]},{"url":"https://github.com/sqlalchemy/mako/commit/000ed85e4e48771eff460bf4fc721fb43de80e08","label":"github.com/sqlalchemy/mako/commit/000ed85e4e48771eff460bf4fc721fb43de80e08","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT","FIX"]},{"url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_4_2","label":"github.com/sqlalchemy/mako/releases/tag/rel_1_4_2","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102991","label":"nvd.nist.gov/vuln/detail/CVE-2026-102991","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sqlalchemy/mako","label":"github.com/sqlalchemy/mako","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://ubuntu.com/security/CVE-2026-102991","label":"ubuntu.com/security/CVE-2026-102991","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102991","label":"www.cve.org/CVERecord?id=CVE-2026-102991","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102991.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102991.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://pypi.org/project/mako","label":"pypi.org/project/mako","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-5639-2j2p-m4mx","label":"github.com/advisories/GHSA-5639-2j2p-m4mx","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-30T19:47:07.128Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T19:54:41.077Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T06:17:43.766Z","stale":false,"partial":false}}