kadet-hub
Image security report: home-assistant recipe
home-assistant: grade F, 88 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 2, HIGH 43, MEDIUM 30, LOW 11, UNKNOWN 2. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
ghcr.io/home-assistant/home-assistant:2026.11.0@sha256:c6c1ca9931036bf3a2c4cc088d8db25dfea3b33935a5ecc83c40349462e2f69e
CRITICAL 2, HIGH 43, MEDIUM 30, LOW 11, UNKNOWN 2
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-85394 | CRITICAL | python-jose | 3.5.0 | |
| CVE-2026-96760 | CRITICAL | Authlib | 1.7.2 | 1.9.0 |
| CVE-2024-23342 | HIGH | ecdsa | 0.19.2 | |
| CVE-2025-22869 | HIGH | golang.org/x/crypto | v0.31.0 | 0.35.0 |
| CVE-2025-47273 | HIGH | setuptools | 70.3.0 | 78.1.1 |
| CVE-2025-47913 | HIGH | golang.org/x/crypto | v0.31.0 | 0.43.0 |
| CVE-2026-111943 | HIGH | stdlib | v1.26.5 | 1.26.10, 1.27.3 |
| CVE-2026-113351 | HIGH | libexpat | 2.9.0-r0 | 2.10.0-r0 |
| CVE-2026-114613 | HIGH | msgpack | 1.1.2 | 1.2.3 |
| CVE-2026-114615 | HIGH | Authlib | 1.7.2 | 1.9.0 |
| CVE-2026-114616 | HIGH | Authlib | 1.7.2 | 1.9.1 |
| CVE-2026-115506 | HIGH | libexpat | 2.9.0-r0 | 2.10.0-r0 |
| CVE-2026-116672 | HIGH | Authlib | 1.7.2 | 1.9.1 |
| CVE-2026-117610 | HIGH | libexpat | 2.9.0-r0 | 2.10.0-r0 |
| CVE-2026-118370 | HIGH | libexpat | 2.9.0-r0 | 2.10.0-r0 |
| CVE-2026-118669 | HIGH | oauthlib | 3.3.1 | 4.0.0 |
| CVE-2026-123158 | HIGH | openssh-client-common | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-client-default | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-123158 | HIGH | openssh-keygen | 10.3_p1-r1 | 10.3_p1-r2 |
| CVE-2026-33818 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39821 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39828 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39829 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39830 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39831 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39832 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39835 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-42508 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-46595 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-46597 | HIGH | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-46600 | HIGH | stdlib | v1.26.5 | 1.26.6, 1.27.0-rc.3 |
| CVE-2026-49272 | HIGH | oauthlib | 3.3.1 | 4.0.1 |
| CVE-2026-56853 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56854 | HIGH | golang.org/x/crypto | v0.31.0 | 0.55.0 |
| CVE-2026-56858 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56859 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56860 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56862 | HIGH | stdlib | v1.26.5 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.61.0 | 0.62.0 |
| CVE-2026-78667 | HIGH | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-78669 | HIGH | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-97031 | HIGH | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-97687 | HIGH | urllib3 | 2.7.0 | 2.8.0 |
| CVE-2026-97689 | HIGH | urllib3 | 2.7.0 | 2.8.0 |
| GHSA-6v7p-g79w-8964 | HIGH | msgpack | 1.1.2 | 1.2.1 |
| CVE-2025-47914 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.45.0 |
| CVE-2025-58181 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.45.0 |
| CVE-2026-114617 | MEDIUM | Authlib | 1.7.2 | 1.9.0 |
| CVE-2026-114618 | MEDIUM | Authlib | 1.7.2 | 1.9.0 |
| CVE-2026-114619 | MEDIUM | Authlib | 1.7.2 | 1.9.0 |
| CVE-2026-114620 | MEDIUM | Authlib | 1.7.2 | 1.9.0 |
| CVE-2026-115567 | MEDIUM | tokio | 1.54.0 | 1.54.1 |
| CVE-2026-39827 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39833 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-39834 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-46598 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.52.0 |
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r1 | 1.4-r0 |
| CVE-2026-49264 | MEDIUM | oauthlib | 3.3.1 | 4.0.0 |
| CVE-2026-49265 | MEDIUM | oauthlib | 3.3.1 | 4.0.0 |
| CVE-2026-56855 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.56.0 |
| CVE-2026-56866 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-59890 | MEDIUM | setuptools | 70.3.0 | 83.0.0 |
| CVE-2026-78659 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-78660 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-78662 | MEDIUM | golang.org/x/crypto | v0.31.0 | 0.56.0 |
| CVE-2026-78663 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-94439 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-94440 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-94448 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-97030 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-97032 | MEDIUM | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.61.0 | 0.62.0 |
| CVE-2026-97688 | MEDIUM | urllib3 | 2.7.0 | 2.8.0 |
| GHSA-c8m5-c952-6cm4 | MEDIUM | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-c8m5-c952-6cm4 | MEDIUM | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| CVE-2026-114614 | LOW | Authlib | 1.7.2 | 1.8.0 |
| CVE-2026-44405 | LOW | paramiko | 3.5.0 | 5.0.0 |
| CVE-2026-56857 | LOW | stdlib | v1.26.5 | 1.26.9, 1.27.2 |
| GHSA-h2v8-394m-p7vv | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-h2v8-394m-p7vv | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-vp88-798v-h67f | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-vp88-798v-h67f | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-w44r-93j7-qv28 | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-w44r-93j7-qv28 | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-xmj3-9gf7-h52w | LOW | setuptools | 84.0.0 | 84.1.0 |
| GHSA-xmj3-9gf7-h52w | LOW | setuptools | 70.3.0 | 84.1.0 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.58.0 | 0.58.1-0.20261009181718-2f1f834330b2 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.31.0 | 0.58.1-0.20261009181718-2f1f834330b2 |