---
title: "Athena Wave 2 - flagging the latest vulnerabilities other scanners can't see"
description: "Chainguard published 12 new Athena vulnerabilities in widely used Java (Maven) libraries that don’t have CVE or GHSA IDs yet. Cloudsmith has a ready-made Rego policy that flags the affected versions in Maven packages and in Docker images that bundle them."
canonical_url: "https://cloudsmith.com/changelog/athena-wave-2"
last_updated: "2026-11-12T20:55:17.558Z"
---
# Athena Wave 2 - flagging the latest vulnerabilities other scanners can't see

Today, Chainguard published its latest batch of Athena vulnerabilities. They're in widely used open source Java libraries and don't have an official CVE designation or GHSA ID yet, so most scanners won't flag them.

As an Athena shield partner, we got access to the embargoed drop ahead of disclosure. We built, tested, and deployed a policy for Athena members. The policy flags the affected versions in both Maven packages and Docker images that bundle them. 



Today, the flagged vulnerabilities are now public and off embargo, so we're rolling them out to all affected customers.

#### **What this means for you**

- If you're using any of the affected packages, we'll be in touch with the policy.
- If you'd like it anyway, contact your account team or support, and we'll send it over.
- We'd suggest starting with a tag action to see what it matches, then switching to quarantine once you're happy.
- Chainguard's patched builds aren't flagged.



The full list of vulnerabilities, affected versions, and patches is in [Chainguard's advisory](https://www.chainguard.dev/unchained/athenas-second-wave).