Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

jamiepine/voicebox

https://github.com/jamiepine/voicebox · scanned 2026-07-23 10:38 UTC (5 days, 4 hours ago)

437 raw signals (0 security + 437 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 4 hours ago · v5 · last Δ +17.5 (diff) · 435 actionable findings from 1 signal source. 2 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
59.1
/100
Security checks
59
0 findings
System graph
59
100.0% cov · 435 findings
Critical
1
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: source: scanner × excluding tests × Reset all
Severity: Critical 1 High 149 Medium 130 Low 111 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 435 Crowd 0 Layer: Software 13 Frontend 35 Security 186 Hardware 3 Cicd 4 Quality 47 Dependencies 85 Api 62
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 59.1/100 with 100.0% coverage. It contains 2764 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 437 findings — concentrated in security (186), dependencies (85), api (62). Risk profile is high: 1 critical, 149 high, 132 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 391 of 435 actionable findings. 437 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-25896: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE en…
VulnCve 2026 25896
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.0 — docs/bun.lock
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.0 — docs/bun.lock
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL pa…
VulnCve 2026 16221
high System graph security Trivy conf 1.00 CVE-2026-26278: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to d…
VulnCve 2026 26278
high System graph security Trivy conf 1.00 CVE-2026-31812: quinn-proto 0.11.13 — tauri/src-tauri/Cargo.lock
quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn version…
VulnCve 2026 31812
high System graph security Trivy conf 1.00 CVE-2026-33036: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, …
VulnCve 2026 33036
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 4.0.3 — docs/bun.lock
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-41676: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, …
VulnCve 2026 41676
high System graph security Trivy conf 1.00 CVE-2026-41678: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reverse…
VulnCve 2026 41678
high System graph security Trivy conf 1.00 CVE-2026-41681: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::diges…
VulnCve 2026 41681
high System graph security Trivy conf 1.00 CVE-2026-41898: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_c…
VulnCve 2026 41898
high System graph security Trivy conf 1.00 CVE-2026-42327: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, w…
VulnCve 2026 42327
high System graph security Trivy conf 1.00 CVE-2026-44573: next 16.1.4 — bun.lock
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44573: next 16.1.6 — docs/bun.lock
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44574: next 16.1.4 — bun.lock
Next.js: Next.js: Authorization bypass via crafted query parameters Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected…
VulnCve 2026 44574
high System graph security Trivy conf 1.00 CVE-2026-44574: next 16.1.6 — docs/bun.lock
Next.js: Next.js: Authorization bypass via crafted query parameters Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected…
VulnCve 2026 44574
high System graph security Trivy conf 1.00 CVE-2026-44575: next 16.1.4 — bun.lock
next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauth…
VulnCve 2026 44575
high System graph security Trivy conf 1.00 CVE-2026-44575: next 16.1.6 — docs/bun.lock
next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauth…
VulnCve 2026 44575
high System graph security Trivy conf 1.00 CVE-2026-44578: next 16.1.4 — bun.lock
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-44578: next 16.1.6 — docs/bun.lock
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-44579: next 16.1.4 — bun.lock
next.js: Next.js: Denial of Service via crafted POST requests to server actions Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection ex…
VulnCve 2026 44579
high System graph security Trivy conf 1.00 CVE-2026-44579: next 16.1.6 — docs/bun.lock
next.js: Next.js: Denial of Service via crafted POST requests to server actions Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection ex…
VulnCve 2026 44579
high System graph security Trivy conf 1.00 CVE-2026-45109: next 16.1.4 — bun.lock
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Tur…
VulnCve 2026 45109
high System graph security Trivy conf 1.00 CVE-2026-45109: next 16.1.6 — docs/bun.lock
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Tur…
VulnCve 2026 45109
high System graph security Trivy conf 1.00 CVE-2026-4926: path-to-regexp 8.3.0 — docs/bun.lock
path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, cau…
VulnCve 2026 4926
high System graph security Trivy conf 1.00 CVE-2026-59869: js-yaml 4.1.1 — docs/bun.lock
js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where…
VulnCve 2026 59869
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — docs/bun.lock
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — docs/bun.lock
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 CVE-2026-64641: next 16.1.4 — bun.lock
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64641: next 16.1.6 — docs/bun.lock
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64642: next 16.1.4 — bun.lock
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale ## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Wor…
VulnCve 2026 64642
high System graph security Trivy conf 1.00 CVE-2026-64642: next 16.1.6 — docs/bun.lock
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale ## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Wor…
VulnCve 2026 64642
high System graph security Trivy conf 1.00 CVE-2026-64645: next 16.1.4 — bun.lock
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64645: next 16.1.6 — docs/bun.lock
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 16.1.4 — bun.lock
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 CVE-2026-64649: next 16.1.6 — docs/bun.lock
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/releases (landing/src/app/capture/page.tsx:18)
`landing/src/app/capture/page.tsx:18` calls `GET /api/releases` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/releases` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/releases (landing/src/app/download/page.tsx:83)
`landing/src/app/download/page.tsx:83` calls `GET /api/releases` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/releases` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/releases (landing/src/app/page.tsx:26)
`landing/src/app/page.tsx:26` calls `GET /api/releases` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/releases` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/stars (landing/src/components/Navbar.tsx:20)
`landing/src/components/Navbar.tsx:20` calls `GET /api/stars` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/stars` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET /cloud/status (app/src/lib/api/client.ts:948)
`app/src/lib/api/client.ts:948` calls `GET /cloud/status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/cloud/status` If this points at an external API, prefix it with `https://` so the matcher skips it.
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: GET /settings/captures (app/src/lib/api/client.ts:496)
`app/src/lib/api/client.ts:496` calls `GET /settings/captures` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/settings/captures` If this points at an external API, prefix it with `https://` so the matcher s…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: GET /settings/generation (app/src/lib/api/client.ts:511)
`app/src/lib/api/client.ts:511` calls `GET /settings/generation` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/settings/generation` If this points at an external API, prefix it with `https://` so the match…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: GET https://huggingface.co/api/models/${repoId} (app/src/components/ServerSettings/ModelManagement.tsx:50)
`app/src/components/ServerSettings/ModelManagement.tsx:50` calls `GET https://huggingface.co/api/models/${repoId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/huggingface.co/api/models/<p>` If this points …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://lite-api.jup.ag/price/v3?ids=${mint} (landing/src/lib/token-stats.ts:387)
`landing/src/lib/token-stats.ts:387` calls `GET https://lite-api.jup.ag/price/v3?ids=${mint}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/lite-api.jup.ag/price/v3` If this points at an external API, prefix…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /cloud/disconnect (app/src/lib/api/client.ts:956)
`app/src/lib/api/client.ts:956` calls `POST /cloud/disconnect` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/cloud/disconnect` If this points at an external API, prefix it with `https://` so the matcher sk…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: POST /cloud/login/start (app/src/lib/api/client.ts:952)
`app/src/lib/api/client.ts:952` calls `POST /cloud/login/start` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/cloud/login/start` If this points at an external API, prefix it with `https://` so the matcher …
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: PUT /settings/captures (app/src/lib/api/client.ts:504)
`app/src/lib/api/client.ts:504` calls `PUT /settings/captures` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/settings/captures` If this points at an external API, prefix it with `https://` so the matcher s…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: PUT /settings/generation (app/src/lib/api/client.ts:517)
`app/src/lib/api/client.ts:517` calls `PUT /settings/generation` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/settings/generation` If this points at an external API, prefix it with `https://` so the match…
Dangling fetchHelper:request
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security auth conf 1.00 FastAPI DELETE `clear_failed_generations` without auth dependency — backend/routes/history.py:65
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/history.py:65 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_capture_endpoint` without auth dependency — backend/routes/captures.py:111
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/captures.py:111 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_channel` without auth dependency — backend/routes/channels.py:59
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/channels.py:59 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_cuda_backend` without auth dependency — backend/routes/cuda.py:51
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/cuda.py:51 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_effect_preset` without auth dependency — backend/routes/effects.py:125
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:125 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_generation_version` without auth dependency — backend/routes/effects.py:244
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:244 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_generation` without auth dependency — backend/routes/history.py:122
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/history.py:122 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_mcp_binding` without auth dependency — backend/routes/mcp_bindings.py:65
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/mcp_bindings.py:65 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_model` without auth dependency — backend/routes/models.py:447
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:447 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_profile_avatar` without auth dependency — backend/routes/profiles.py:269
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:269 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_profile_sample` without auth dependency — backend/routes/profiles.py:203
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:203 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_profile` without auth dependency — backend/routes/profiles.py:137
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:137 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_rocm_backend` without auth dependency — backend/routes/rocm.py:44
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/rocm.py:44 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_story` without auth dependency — backend/routes/stories.py:60
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:60 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `remove_story_item` without auth dependency — backend/routes/stories.py:85
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:85 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `add_profile_sample` without auth dependency — backend/routes/profiles.py:153
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:153 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `add_story_item` without auth dependency — backend/routes/stories.py:72
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:72 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `apply_effects_to_generation` without auth dependency — backend/routes/effects.py:156
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:156 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cancel_generation` without auth dependency — backend/routes/generations.py:235
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:235 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cancel_model_download` without auth dependency — backend/routes/models.py:428
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:428 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `clear_all_tasks` without auth dependency — backend/routes/tasks.py:16
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/tasks.py:16 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `clear_cache` without auth dependency — backend/routes/tasks.py:32
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/tasks.py:32 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `cloud_disconnect` without auth dependency — backend/routes/cloud.py:72
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/cloud.py:72 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `compose_in_character` without auth dependency — backend/routes/profiles.py:374
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:374 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_capture_endpoint` without auth dependency — backend/routes/captures.py:24
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/captures.py:24 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_channel` without auth dependency — backend/routes/channels.py:19
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/channels.py:19 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_effect_preset` without auth dependency — backend/routes/effects.py:93
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:93 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_profile` without auth dependency — backend/routes/profiles.py:25
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:25 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_story` without auth dependency — backend/routes/stories.py:23
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:23 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `download_cuda_backend` without auth dependency — backend/routes/cuda.py:24
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/cuda.py:24 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `download_rocm_backend` without auth dependency — backend/routes/rocm.py:24
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/rocm.py:24 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `duplicate_story_item` without auth dependency — backend/routes/stories.py:182
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:182 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate_speech` without auth dependency — backend/routes/generations.py:56
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:56 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `import_audio` without auth dependency — backend/routes/generations.py:405
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:405 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `import_generation` without auth dependency — backend/routes/history.py:41
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/history.py:41 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `import_profile` without auth dependency — backend/routes/profiles.py:45
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:45 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `llm_generate` without auth dependency — backend/routes/llm.py:19
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/llm.py:19 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `load_model` without auth dependency — backend/routes/models.py:50
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:50 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `migrate_models` without auth dependency — backend/routes/models.py:121
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:121 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `preview_effects` without auth dependency — backend/routes/effects.py:18
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:18 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `refine_capture_endpoint` without auth dependency — backend/routes/captures.py:119
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/captures.py:119 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `regenerate_generation` without auth dependency — backend/routes/generations.py:190
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:190 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `retranscribe_capture_endpoint` without auth dependency — backend/routes/captures.py:203
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/captures.py:203 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `retry_generation` without auth dependency — backend/routes/generations.py:148
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:148 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `shutdown` without auth dependency — backend/routes/health.py:35
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/health.py:35 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `speak` without auth dependency — backend/routes/speak.py:27
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/speak.py:27 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `split_story_item` without auth dependency — backend/routes/stories.py:168
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:168 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `start_cloud_login` without auth dependency — backend/routes/cloud.py:30
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/cloud.py:30 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stream_speech` without auth dependency — backend/routes/generations.py:318
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/generations.py:318 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `toggle_favorite` without auth dependency — backend/routes/history.py:108
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/history.py:108 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `transcribe_audio` without auth dependency — backend/routes/transcription.py:23
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/transcription.py:23 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `trigger_model_download` without auth dependency — backend/routes/models.py:390
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:390 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `unload_model_by_name` without auth dependency — backend/routes/models.py:75
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:75 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `unload_model` without auth dependency — backend/routes/models.py:63
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/models.py:63 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `upload_profile_avatar` without auth dependency — backend/routes/profiles.py:228
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:228 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `watchdog_disable` without auth dependency — backend/routes/health.py:47
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/health.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `move_story_item` without auth dependency — backend/routes/stories.py:126
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:126 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `reorder_story_items` without auth dependency — backend/routes/stories.py:111
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:111 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `set_channel_voices` without auth dependency — backend/routes/channels.py:87
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/channels.py:87 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `set_default_version` without auth dependency — backend/routes/effects.py:222
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:222 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `set_profile_channels` without auth dependency — backend/routes/profiles.py:323
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:323 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `set_story_item_version` without auth dependency — backend/routes/stories.py:195
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:195 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `trim_story_item` without auth dependency — backend/routes/stories.py:140
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:140 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_capture_settings_endpoint` without auth dependency — backend/routes/settings.py:18
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/settings.py:18 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_channel` without auth dependency — backend/routes/channels.py:43
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/channels.py:43 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_effect_preset` without auth dependency — backend/routes/effects.py:107
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/effects.py:107 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_generation_settings_endpoint` without auth dependency — backend/routes/settings.py:31
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/settings.py:31 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_profile_effects` without auth dependency — backend/routes/profiles.py:337
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:337 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_profile_sample` without auth dependency — backend/routes/profiles.py:215
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:215 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_profile` without auth dependency — backend/routes/profiles.py:121
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/profiles.py:121 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_story_item_times` without auth dependency — backend/routes/stories.py:98
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:98 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_story_item_volume` without auth dependency — backend/routes/stories.py:154
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:154 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_story` without auth dependency — backend/routes/stories.py:47
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/stories.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `upsert_mcp_binding` without auth dependency — backend/routes/mcp_bindings.py:37
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/routes/mcp_bindings.py:37 securityAuth fastapi unauth mutation
high System graph security Trivy conf 1.00 GHSA-82j2-j2ch-gfr8: rustls-webpki 0.103.9 — tauri/src-tauri/Cargo.lock
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING ### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public…
VulnGhsa 82j2 j2ch gfr8
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 16.1.4 — bun.lock
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 16.1.6 — docs/bun.lock
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-h25m-26qc-wcjf: next 16.1.4 — bun.lock
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x usin…
VulnGhsa h25m 26qc wcjf
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 16.1.4 — bun.lock
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 16.1.6 — docs/bun.lock
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph security security conf 1.00 Insecure pattern 'exec_used' in backend/pyi_rth_torch_compiler_disable.py:335
Found a known-risky pattern (exec_used). Review and replace if possible.
backend/pyi_rth_torch_compiler_disable.py:335 Exec used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/setup-dev-sidecar.js:13
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/setup-dev-sidecar.js:13 Node child process
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-267c-6grr-h53f
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-267c-6grr-h53f (aka CVE-2026-44575). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes Aliases: CVE-2026-44575 Advisory: https://osv.dev/vulnerability/GHSA-267c-6gr…
landing/package.json ScaOsvGhsa 267c 6grr h53f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-26hh-7cqf-hhc6
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-26hh-7cqf-hhc6 (aka CVE-2026-45109). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up Aliases: CVE-2026-45109 Advisory: https://osv.dev/…
landing/package.json ScaOsvGhsa 26hh 7cqf hhc6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5 Fix: upg…
landing/package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-492v-c6pp-mqqv
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-492v-c6pp-mqqv (aka CVE-2026-44574). Next.js has a Middleware / Proxy bypass through dynamic route parameter injection Aliases: CVE-2026-44574 Advisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv Fix: u…
landing/package.json ScaOsvGhsa 492v c6pp mqqv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-6gpp-xcg3-4w24
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-6gpp-xcg3-4w24 (aka CVE-2026-64642). Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale Aliases: CVE-2026-64642 Advisory: https://osv.dev/vulnerability/GHSA-6gpp-xc…
landing/package.json ScaOsvGhsa 6gpp xcg3 4w24
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x Fix: upgrade `n…
landing/package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-c4j6-fc7j-m34r (aka CVE-2026-44578). Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades Aliases: CVE-2026-44578 Advisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m3…
landing/package.json ScaOsvGhsa c4j6 fc7j m34r
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-267c-6grr-h53f
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-267c-6grr-h53f (aka CVE-2026-44575). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes Aliases: CVE-2026-44575 Advisory: https://osv.dev/vulnerability/GHSA-267…
docs/package.json ScaOsvGhsa 267c 6grr h53f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-26hh-7cqf-hhc6
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-26hh-7cqf-hhc6 (aka CVE-2026-45109). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up Aliases: CVE-2026-45109 Advisory: https://osv…
docs/package.json ScaOsvGhsa 26hh 7cqf hhc6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5 Fix…
docs/package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-492v-c6pp-mqqv
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-492v-c6pp-mqqv (aka CVE-2026-44574). Next.js has a Middleware / Proxy bypass through dynamic route parameter injection Aliases: CVE-2026-44574 Advisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv F…
docs/package.json ScaOsvGhsa 492v c6pp mqqv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-6gpp-xcg3-4w24
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-6gpp-xcg3-4w24 (aka CVE-2026-64642). Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale Aliases: CVE-2026-64642 Advisory: https://osv.dev/vulnerability/GHSA-6g…
docs/package.json ScaOsvGhsa 6gpp xcg3 4w24
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x Fix: upgra…
docs/package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-c4j6-fc7j-m34r (aka CVE-2026-44578). Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades Aliases: CVE-2026-44578 Advisory: https://osv.dev/vulnerability/GHSA-c4j6-fc…
docs/package.json ScaOsvGhsa c4j6 fc7j m34r
high System graph dependencies dependencies conf 0.70 Vulnerable dependency tauri 2.0: GHSA-7gmj-67g7-phm9
OSV.dev reports `tauri` at version `2.0` (declared in `tauri/src-tauri/Cargo.toml`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Note: `2.0` is the declared floor of a range — the installed version may be newer. Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Loc…
tauri/src-tauri/Cargo.toml ScaOsvGhsa 7gmj 67g7 phm9
high System graph dependencies dependencies conf 1.00 Vulnerable dependency tauri 2.9.5: GHSA-7gmj-67g7-phm9
OSV.dev reports `tauri` at version `2.9.5` (resolved in `tauri/src-tauri/Cargo.lock`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands Aliases: CVE-2026-42184 Advisory: https://osv.dev/vulnerabi…
tauri/src-tauri/Cargo.lock ScaOsvGhsa 7gmj 67g7 phm9
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — landing/src/app/blog/[slug]/page.tsx:85
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/src/components/AudioPlayer/AudioPlayer.tsx:444
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/src/components/CapturesTab/CapturesTab.tsx:344
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/src/components/ServerSettings/ModelManagement.tsx:50
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/src/lib/api/core/request.ts:230
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — app/src/lib/hooks/useStoryPlayback.ts:128
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — landing/src/lib/token-stats.ts:263
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-59471: next 16.1.4 — bun.lock
next: NextJS Denial of Service in Image Optimizer A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcin…
VulnCve 2025 59471
medium System graph security Trivy conf 1.00 CVE-2025-59472: next 16.1.4 — bun.lock
next: NextJS Denial of Service in Partial Pre Rendering A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes at…
VulnCve 2025 59472
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 8.17.1 — docs/bun.lock
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2026-25541: bytes 1.11.0 — tauri/src-tauri/Cargo.lock
Bytes is a utility library for working with bytes. From version 1.2.1 ... Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capa…
VulnCve 2026 25541
medium System graph security Trivy conf 1.00 CVE-2026-25727: time 0.3.46 — tauri/src-tauri/Cargo.lock
time: time affected by a stack exhaustion denial of service attack time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The atta…
VulnCve 2026 25727
medium System graph security Trivy conf 1.00 CVE-2026-27978: next 16.1.4 — bun.lock
next.js: Next.js: null origin can bypass Server Actions CSRF checks Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, req…
VulnCve 2026 27978
medium System graph security Trivy conf 1.00 CVE-2026-27978: next 16.1.6 — docs/bun.lock
next.js: Next.js: null origin can bypass Server Actions CSRF checks Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, req…
VulnCve 2026 27978
medium System graph security Trivy conf 1.00 CVE-2026-27979: next 16.1.4 — bun.lock
next.js: Next.js: Unbounded postponed resume buffering can lead to DoS Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buf…
VulnCve 2026 27979
medium System graph security Trivy conf 1.00 CVE-2026-27979: next 16.1.6 — docs/bun.lock
next.js: Next.js: Unbounded postponed resume buffering can lead to DoS Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buf…
VulnCve 2026 27979
medium System graph security Trivy conf 1.00 CVE-2026-27980: next 16.1.4 — bun.lock
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable…
VulnCve 2026 27980
medium System graph security Trivy conf 1.00 CVE-2026-27980: next 16.1.6 — docs/bun.lock
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable…
VulnCve 2026 27980
medium System graph security Trivy conf 1.00 CVE-2026-29057: next 16.1.4 — bun.lock
next.js: Next.js: HTTP request smuggling in rewrites Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Tr…
VulnCve 2026 29057
medium System graph security Trivy conf 1.00 CVE-2026-29057: next 16.1.6 — docs/bun.lock
next.js: Next.js: HTTP request smuggling in rewrites Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Tr…
VulnCve 2026 29057
medium System graph security Trivy conf 1.00 CVE-2026-33055: tar 0.4.44 — tauri/src-tauri/Cargo.lock
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4 ... tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral…
VulnCve 2026 33055
medium System graph security Trivy conf 1.00 CVE-2026-33056: tar 0.4.44 — tauri/src-tauri/Cargo.lock
tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exi…
VulnCve 2026 33056
medium System graph security Trivy conf 1.00 CVE-2026-33349: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeRead…
VulnCve 2026 33349
medium System graph security Trivy conf 1.00 CVE-2026-33532: yaml 2.8.2 — docs/bun.lock
yaml: yaml: Denial of Service via deeply nested YAML document parsing `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The no…
VulnCve 2026 33532
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 4.0.3 — docs/bun.lock
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.6 — bun.lock
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.6 — docs/bun.lock
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41650: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or th…
VulnCve 2026 41650
medium System graph security Trivy conf 1.00 CVE-2026-42184: tauri 2.9.5 — tauri/src-tauri/Cargo.lock
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local or…
VulnCve 2026 42184
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 16.1.4 — bun.lock
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 16.1.6 — docs/bun.lock
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 16.1.4 — bun.lock
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 16.1.6 — docs/bun.lock
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 16.1.4 — bun.lock
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 16.1.6 — docs/bun.lock
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 16.1.4 — bun.lock
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 16.1.6 — docs/bun.lock
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-44662: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffe…
VulnCve 2026 44662
medium System graph security Trivy conf 1.00 CVE-2026-45784: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-…
VulnCve 2026 45784
medium System graph security Trivy conf 1.00 CVE-2026-4923: path-to-regexp 8.3.0 — docs/bun.lock
path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second…
VulnCve 2026 4923
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.1 — docs/bun.lock
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-64643: next 16.1.4 — bun.lock
Next.js: Unauthenticated disclosure of internal Server Function endpoints ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action ID…
VulnCve 2026 64643
medium System graph security Trivy conf 1.00 CVE-2026-64643: next 16.1.6 — docs/bun.lock
Next.js: Unauthenticated disclosure of internal Server Function endpoints ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action ID…
VulnCve 2026 64643
medium System graph security Trivy conf 1.00 CVE-2026-64644: next 16.1.4 — bun.lock
Next.js: Denial of Service in the Image Optimization API using SVGs ### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause …
VulnCve 2026 64644
medium System graph security Trivy conf 1.00 CVE-2026-64644: next 16.1.6 — docs/bun.lock
Next.js: Denial of Service in the Image Optimization API using SVGs ### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause …
VulnCve 2026 64644
medium System graph security Trivy conf 1.00 CVE-2026-64646: next 16.1.4 — bun.lock
Next.js: Unbounded Server Action payload in Edge runtime ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hos…
VulnCve 2026 64646
medium System graph security Trivy conf 1.00 CVE-2026-64646: next 16.1.6 — docs/bun.lock
Next.js: Unbounded Server Action payload in Edge runtime ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hos…
VulnCve 2026 64646
medium System graph security Trivy conf 1.00 CVE-2026-64647: next 16.1.4 — bun.lock
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **r…
VulnCve 2026 64647
medium System graph security Trivy conf 1.00 CVE-2026-64647: next 16.1.6 — docs/bun.lock
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **r…
VulnCve 2026 64647
medium System graph security Trivy conf 1.00 CVE-2026-64648: next 16.1.4 — bun.lock
Next.js: Cache confusion of response bodies for requests with bodies ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauth…
VulnCve 2026 64648
medium System graph security Trivy conf 1.00 CVE-2026-64648: next 16.1.6 — docs/bun.lock
Next.js: Cache confusion of response bodies for requests with bodies ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauth…
VulnCve 2026 64648
medium System graph dependencies dependencies conf 0.90 Dependency @hookform/resolvers is two or more major versions behind
`@hookform/resolvers` is pinned at `3.9.0` in `app/package.json` while the latest release on the npm registry is `5.4.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@hookform/resolv…
app/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency screencapturekit is two or more major versions behind
`screencapturekit` is pinned at `1` in `tauri/src-tauri/Cargo.toml` while the latest release on the cargo registry is `8.0.1` — 7 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `screencaptu…
tauri/src-tauri/Cargo.toml FreshnessOutdated
medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: 'cd web && bunx --bun vite build'. Use 'WORKDIR' statement instead. Rule: DS-0013 Severity: MEDIUM Target: Dockerfile
Misconfig
medium System graph security Semgrep conf 1.00 exec detected — backend/pyi_rth_torch_compiler_disable.py:335
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
SecurityPython
medium System graph security Semgrep conf 1.00 exec detected — backend/pyi_rth_torch_compiler_disable.py:461
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
SecurityPython
medium System graph security Trivy conf 1.00 GHSA-3pv8-6f4r-ffg2: tar 0.4.44 — tauri/src-tauri/Cargo.lock
tar has a PAX header desynchronization issue ### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would…
VulnGhsa 3pv8 6f4r ffg2
medium System graph security Trivy conf 1.00 GHSA-7gcf-g7xr-8hxj: serde_with 3.16.1 — tauri/src-tauri/Cargo.lock
serde_with: KeyValueMap serialization panics on empty sequence or map entries ### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumptio…
VulnGhsa 7gcf g7xr 8hxj
medium System graph security Trivy conf 1.00 GHSA-pwjx-qhcg-rvj4: rustls-webpki 0.103.9 — tauri/src-tauri/Cargo.lock
webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic If a certificate had more than one `distributionPoint`, then only the first `distributionPoint` would be considered against each CRL's `IssuingDistributionPoint` `distributionPoint`, and then the certifica…
VulnGhsa pwjx qhcg rvj4
medium System graph security Trivy conf 1.00 GHSA-wrw7-89jp-8q8g: glib 0.18.5 — tauri/src-tauri/Cargo.lock
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable referenc…
VulnGhsa wrw7 89jp 8q8g
medium System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
3 files, 3 locations
.github/workflows/build-windows.yml:16
.github/workflows/ci.yml:17
.github/workflows/release.yml:71
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/release.yml CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/build-windows.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in landing/src/app/blog/[slug]/page.tsx:85
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
landing/src/app/blog/[slug]/page.tsx:85 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in app/src/components/Generation/ParalinguisticInput.tsx:159
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
app/src/components/Generation/ParalinguisticInput.tsx:159 Direct innerhtml assignment
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — backend/build_binary.py:499
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 95 placeholder/mock markers across 31 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
31 test file(s) for 376 source file(s) (ratio 0.08). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/core 7.28.6: GHSA-4x5r-pxfx-6jf8
OSV.dev reports `@babel/core` at version `7.28.6` (resolved in `bun.lock`) is affected by GHSA-4x5r-pxfx-6jf8. Note: `@babel/core` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA…
bun.lock ScaOsvGhsa 4x5r pxfx 6jf8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `6.12.6` (resolved in `bun.lock`) is affected by GHSA-2g4f-4pwh-qvx6. Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6 …
bun.lock ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `bun.lock`) is affected by GHSA-3jxr-9vmj-r5cp. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
bun.lock ScaOsvGhsa 3jxr 9vmj r5cp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `bun.lock`) is affected by GHSA-f886-m6hf-6m8v. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
bun.lock ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.21.5` (resolved in `bun.lock`) is affected by GHSA-67mh-4wv8-2f99. Note: `esbuild` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-67mh-4w…
bun.lock ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.3.3: GHSA-25h7-pfq9-p65f
OSV.dev reports `flatted` at version `3.3.3` (resolved in `bun.lock`) is affected by GHSA-25h7-pfq9-p65f. Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-25h7-pfq…
bun.lock ScaOsvGhsa 25h7 pfq9 p65f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.3.3: GHSA-rf6f-7fwh-wjgh
OSV.dev reports `flatted` at version `3.3.3` (resolved in `bun.lock`) is affected by GHSA-rf6f-7fwh-wjgh. Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rf6f-7fw…
bun.lock ScaOsvGhsa rf6f 7fwh wjgh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `bun.lock`) is affected by GHSA-23c5-xmqv-rm74. Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-23c5…
bun.lock ScaOsvGhsa 23c5 xmqv rm74
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `bun.lock`) is affected by GHSA-3ppc-4f35-3m26. Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3ppc…
bun.lock ScaOsvGhsa 3ppc 4f35 3m26
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `bun.lock`) is affected by GHSA-7r86-cg39-jmmj. Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-7r86…
bun.lock ScaOsvGhsa 7r86 cg39 jmmj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-3x4c-7xq6-9pq8
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-3x4c-7xq6-9pq8 (aka CVE-2026-27980). Next.js: Unbounded next/image disk cache growth can exhaust storage Aliases: CVE-2026-27980 Advisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 Fix: upgrade `next` …
landing/package.json ScaOsvGhsa 3x4c 7xq6 9pq8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.dev/vulnerability…
landing/package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `next` past the af…
landing/package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-5f7q-jpqc-wp7h
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-5f7q-jpqc-wp7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5f7q-jpqc-wp7h Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa 5f7q jpqc wp7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix: upgrade `next`…
landing/package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp Fix: upgrade `…
landing/package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-9g9p-9gw9-jx7f
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-9g9p-9gw9-jx7f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa 9g9p 9gw9 jx7f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-ffhc-5mcf-pf4q (aka CVE-2026-44581). Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces Aliases: CVE-2026-44581 Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q F…
landing/package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-ggv3-7p47-pfv8
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-ggv3-7p47-pfv8 (aka CVE-2026-29057). Next.js: HTTP request smuggling in rewrites Aliases: CVE-2026-29057 Advisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 Fix: upgrade `next` past the affected range …
landing/package.json ScaOsvGhsa ggv3 7p47 pfv8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-gx5p-jg67-6x7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-h25m-26qc-wcjf
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-h25m-26qc-wcjf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa h25m 26qc wcjf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-h27x-g6w4-24gq
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-h27x-g6w4-24gq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h27x-g6w4-24gq Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa h27x g6w4 24gq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-h64f-5h5j-jqjh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-jcc7-9wpm-mj36
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-jcc7-9wpm-mj36. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jcc7-9wpm-mj36 Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa jcc7 9wpm mj36
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-m99w-x7hq-7vfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa m99w x7hq 7vfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-mg66-mrh9-m8jx
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-mg66-mrh9-m8jx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa mg66 mrh9 m8jx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-mq59-m269-xvcx
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-mq59-m269-xvcx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mq59-m269-xvcx Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa mq59 m269 xvcx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-p9j2-gv94-2wf4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa p9j2 gv94 2wf4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-q4gf-8mx6-v5v3
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-q4gf-8mx6-v5v3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa q4gf 8mx6 v5v3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-q8wf-6r8g-63ch
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-q8wf-6r8g-63ch. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa q8wf 6r8g 63ch
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa vfv6 92ff j949
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.4: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `16.1.4` (resolved in `bun.lock`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.
landing/package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-3x4c-7xq6-9pq8
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-3x4c-7xq6-9pq8 (aka CVE-2026-27980). Next.js: Unbounded next/image disk cache growth can exhaust storage Aliases: CVE-2026-27980 Advisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 Fix: upgrade `n…
docs/package.json ScaOsvGhsa 3x4c 7xq6 9pq8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.dev/vulnerab…
docs/package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `next` past t…
docs/package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix: upgrade `…
docs/package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp Fix: upgr…
docs/package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-ffhc-5mcf-pf4q (aka CVE-2026-44581). Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces Aliases: CVE-2026-44581 Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-p…
docs/package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-ggv3-7p47-pfv8
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-ggv3-7p47-pfv8 (aka CVE-2026-29057). Next.js: HTTP request smuggling in rewrites Aliases: CVE-2026-29057 Advisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 Fix: upgrade `next` past the affected r…
docs/package.json ScaOsvGhsa ggv3 7p47 pfv8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-gx5p-jg67-6x7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-h27x-g6w4-24gq
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-h27x-g6w4-24gq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h27x-g6w4-24gq Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa h27x g6w4 24gq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-h64f-5h5j-jqjh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-jcc7-9wpm-mj36
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-jcc7-9wpm-mj36. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jcc7-9wpm-mj36 Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa jcc7 9wpm mj36
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-m99w-x7hq-7vfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa m99w x7hq 7vfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-mg66-mrh9-m8jx
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-mg66-mrh9-m8jx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa mg66 mrh9 m8jx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-mq59-m269-xvcx
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-mq59-m269-xvcx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mq59-m269-xvcx Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa mq59 m269 xvcx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-p9j2-gv94-2wf4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa p9j2 gv94 2wf4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-q4gf-8mx6-v5v3
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-q4gf-8mx6-v5v3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa q4gf 8mx6 v5v3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-q8wf-6r8g-63ch
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-q8wf-6r8g-63ch. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa q8wf 6r8g 63ch
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa vfv6 92ff j949
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `16.1.6` (resolved in `docs/bun.lock`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.
docs/package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p
OSV.dev reports `picomatch` at version `2.3.1` (resolved in `bun.lock`) is affected by GHSA-3v7f-55p6-f55p. Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3v7f…
bun.lock ScaOsvGhsa 3v7f 55p6 f55p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj
OSV.dev reports `picomatch` at version `2.3.1` (resolved in `bun.lock`) is affected by GHSA-c2c7-rcm5-vvqj. Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c2c7…
bun.lock ScaOsvGhsa c2c7 rcm5 vvqj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.4.31` (resolved in `bun.lock`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.
bun.lock ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.5.6` (resolved in `bun.lock`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.
landing/package.json ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tauri-plugin-shell 2.0: GHSA-c9pr-q8gx-3mgp
OSV.dev reports `tauri-plugin-shell` at version `2.0` (declared in `tauri/src-tauri/Cargo.toml`) is affected by GHSA-c9pr-q8gx-3mgp. Note: `2.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c9pr-q8gx-…
tauri/src-tauri/Cargo.toml ScaOsvGhsa c9pr q8gx 3mgp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 5.4.21: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `5.4.21` (resolved in `bun.lock`) is affected by GHSA-4w7w-66w2-5vf9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9 Fix: upgrade `vite` past the affected range per the advisory.
app/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 5.4.21: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `5.4.21` (resolved in `bun.lock`) is affected by GHSA-fx2h-pf6j-xcff. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff Fix: upgrade `vite` past the affected range per the advisory.
app/package.json ScaOsvGhsa fx2h pf6j xcff
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 5.4.21: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `5.4.21` (resolved in `bun.lock`) is affected by GHSA-v6wh-96g9-6wx3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 Fix: upgrade `vite` past the affected range per the advisory.
app/package.json ScaOsvGhsa v6wh 96g9 6wx3
low System graph frontend Frontend quality conf 1.00 "active" state uses light bg in a dark theme — landing/src/components/CapturesMockup.tsx:64
A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead — border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '…'`. Why: P-E in CHEC…
Fq active light bg
low System graph frontend Frontend quality conf 1.00 "active" state uses light bg in a dark theme — landing/src/components/ControlUI.tsx:759
A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead — border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '…'`. Why: P-E in CHEC…
Fq active light bg
low System graph frontend Frontend quality conf 1.00 "active" state uses light bg in a dark theme — landing/src/components/Personalities.tsx:84
A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead — border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '…'`. Why: P-E in CHEC…
Fq active light bg
low System graph security Trivy conf 1.00 CVE-2026-27942: fast-xml-parser 4.5.3 — docs/bun.lock
fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user…
VulnCve 2026 27942
low System graph security Trivy conf 1.00 CVE-2026-27977: next 16.1.4 — bun.lock
next.js: Next.js: null origin can bypass dev HMR websocket CSRF checks Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as …
VulnCve 2026 27977
low System graph security Trivy conf 1.00 CVE-2026-27977: next 16.1.6 — docs/bun.lock
next.js: Next.js: null origin can bypass dev HMR websocket CSRF checks Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as …
VulnCve 2026 27977
low System graph security Trivy conf 1.00 CVE-2026-41677: openssl 0.10.75 — tauri/src-tauri/Cargo.lock
rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that ret…
VulnCve 2026 41677
low System graph security Trivy conf 1.00 CVE-2026-44572: next 16.1.4 — bun.lock
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path ha…
VulnCve 2026 44572
low System graph security Trivy conf 1.00 CVE-2026-44572: next 16.1.6 — docs/bun.lock
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path ha…
VulnCve 2026 44572
low System graph security Trivy conf 1.00 CVE-2026-44582: next 16.1.4 — bun.lock
Next.js: Next.js: Cache poisoning allows incorrect response delivery Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with…
VulnCve 2026 44582
low System graph security Trivy conf 1.00 CVE-2026-44582: next 16.1.6 — docs/bun.lock
Next.js: Next.js: Cache poisoning allows incorrect response delivery Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with…
VulnCve 2026 44582
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 88 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: oven/bun:1
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:14 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:32 containersPinned dependencies
low System graph security Trivy conf 1.00 GHSA-965h-392x-2mh5: rustls-webpki 0.103.9 — tauri/src-tauri/Cargo.lock
webpki: Name constraints for URI names were incorrectly accepted Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected un…
VulnGhsa 965h 392x 2mh5
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.7.3 — tauri/src-tauri/Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.8.5 — tauri/src-tauri/Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.9.2 — tauri/src-tauri/Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.103.9 — tauri/src-tauri/Cargo.lock
webpki: Name constraints were accepted for certificates asserting a wildcard name Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly …
VulnGhsa xgp8 3hg3 c2mh
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 10 places
Functions with the same first-5-line body hash: backend/backends/luxtts_backend.py:generate, backend/backends/hume_backend.py:generate, backend/backends/kokoro_backend.py:generate, backend/backends/__init__.py:generate This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — …
duplicatesduplication

Showing first 300 of 391. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/10ed9790-dd7c-4ca8-a4ad-adb99bbaefdf/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/10ed9790-dd7c-4ca8-a4ad-adb99bbaefdf/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.