Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
158 of your 229 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 264.13s for a 1078.9 MB repo slow.
  • Repobility's analysis ran in 61.88s after the clone landed.

odoo/odoo

https://github.com/odoo/odoo.git · scanned 2026-07-27 15:03 UTC (1 month, 2 weeks ago) · 10 languages

1731 raw signals (203 security + 1528 graph) 10/13 scanners ran 50th percentile · Python · huge (>500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v3 · 1611 actionable findings from 2 signal sources. 120 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
74.9
/100
Security checks
77
83 findings
System graph
72
90.0% cov · 1528 findings
Critical
4
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 100.0 0.25 25.00
testing_score 82.0 0.20 16.40
documentation_score 82.0 0.15 12.30
practices_score 57.0 0.15 8.55
code_quality 55.0 0.10 5.50
Overall 1.00 76.8
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 4 High 176 Medium 530 Low 470 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 83 System graph 1528 Crowd 0 Layer: Software 33 Quality 497 Security 311 Frontend 381 Network 1 Dependencies 383 Api 5
Scan summary Repository scanned at 72.4/100 with 90.0% coverage. It contains 96121 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 1528 findings — concentrated in quality (433), dependencies (383), frontend (381). Risk profile is high: 4 critical, 169 high, 525 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 1173 of 1611 actionable findings. 1731 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low Security checks quality Quality conf 1.00 ✓ Repobility [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection.
Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context.
addons/event_product/models/event_type_ticket.py:89
low Security checks quality Quality conf 1.00 ✓ Repobility [MINED007] Sql String Concat: cursor.execute(f"... {user_input} ...") — SQL injection.
Review and fix per the pattern semantics. See CWE-89 / A03:2021 for context.
addons/event_booth_sale/models/event_booth_category.py:122
high Security checks quality Quality conf 1.00 ✓ Repobility 22 occurrences [MINED107] Missing import: `html` used but not imported: The file uses `html.something(...)` but never imports `html`. This raises NameError at runtime the first time the line executes.
Add `import html` at the top of the file.
12 files, 14 locations
odoo/addons/base/models/ir_actions.py:518, 765 (2 hits)
odoo/tools/misc.py:643, 1964 (2 hits)
odoo/_monkeypatches/lxml.py:29
odoo/_monkeypatches/werkzeug.py:431
odoo/addons/base/models/assetsbundle.py:398
odoo/addons/base/models/ir_attachment.py:931
odoo/addons/base/models/ir_autovacuum.py:45
odoo/addons/base/models/ir_fields.py:668
critical System graph security Trivy conf 1.00 CVE-2023-41419: gevent 21.8.0 — requirements.txt
python-gevent: privilege escalation via a crafted script to the WSGIServer component An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. Package: gevent Installed: 21.8.0 Fixed in: 23.9.0 Severity: CRITICAL Fix…
VulnCve 2023 41419
critical System graph security Trivy conf 1.00 CVE-2023-41419: gevent 22.10.2 — requirements.txt
python-gevent: privilege escalation via a crafted script to the WSGIServer component An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. Package: gevent Installed: 22.10.2 Fixed in: 23.9.0 Severity: CRITICAL Fi…
VulnCve 2023 41419
critical System graph security Trivy conf 1.00 CVE-2023-50447: Pillow 9.0.1 — requirements.txt
pillow: Arbitrary Code Execution via the environment parameter Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Package: Pillow Installed: 9.0.1 Fixed i…
VulnCve 2023 50447
critical System graph security Trivy conf 1.00 CVE-2023-50447: Pillow 9.4.0 — requirements.txt
pillow: Arbitrary Code Execution via the environment parameter Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Package: Pillow Installed: 9.4.0 Fixed i…
VulnCve 2023 50447
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState — React skips re-render on mutated reference.
Review and fix per the pattern semantics. See CWE-682 / for context.
addons/html_editor/static/src/main/chatgpt/chatgpt_translate_dialog.js:47
high Security checks quality Quality conf 1.00 ✓ Repobility 3 occurrences [MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render.
Review and fix per the pattern semantics. See CWE-682 / for context.
3 files, 3 locations
addons/account/static/src/components/account_move_form/account_move_form.js:51
addons/account/static/src/components/product_catalog/search/search_panel.js:54
addons/account/static/src/components/tax_totals/tax_totals.js:70
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED106] Phantom test coverage: test_odoo: Test function `test_odoo` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
Add an explicit assertion that captures the test's intent, or remove the test.
setup/package.py:252
high Security checks quality Quality conf 1.00 ✓ Repobility [MINED106] Phantom test coverage: test_python_expr: Test function `test_python_expr` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.
Add an explicit assertion that captures the test's intent, or remove the test.
odoo/tools/safe_eval.py:422
high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences [MINED108] `self._cr` used but never assigned in __init__: Method `rollback` of class `_FlushingSavepoint` reads `self._cr`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.
Initialize `self._cr = <default>` in __init__, or add a class-level default.
3 files, 25 locations
setup/package.py:284, 285, 286, 290, 304, 321, 325, 334, +6 more (15 hits)
odoo/sql_db.py:138, 139, 143, 146, 411, 534, 565, 566, +1 more (9 hits)
setup/requirements-check.py:230
low Security checks security Injection conf 1.00 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: _obj.execute('SELECT * FROM t WHERE id = %s', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
addons/event_product/models/event_type_ticket.py:89
low Security checks security Injection conf 1.00 [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.
Use parameterized queries: _obj.execute('SELECT * FROM t WHERE id = %s', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.
addons/event_booth_sale/models/event_booth_category.py:122
low Security checks security path traversal conf 0.80 3 occurrences [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.
Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.
3 files, 3 locations
addons/crm_livechat/static/src/core/thread_actions.js:35
addons/html_builder/static/src/core/building_blocks/builder_urlpicker.js:45
addons/html_editor/static/src/others/dynamic_placeholder_plugin.js:24
high Security checks security Secret conf 1.00 [SEC043] Secret stored in Odoo ir.config_parameter — broadly readable: ir.config_parameter is readable by any user with read access on the model — typically all internal users. Storing API keys, OAuth client secrets, or passwords there means any admin-account compromise, or any third-party module with broad read scope, exposes the credential. Odoo-specific instance of CWE-922 (insecure storage of sensitive info).
Move to environment variables (loaded at server start, not in DB): api_key = os.environ.get('STRIPE_API_KEY') Or use Odoo's dedicated 'res.config.settings' with restricted ACL: - Set groups='base.group_system' on the field - Use sudo() reads only from server-trusted code paths Or a secrets-ma…
addons/auth_password_policy/models/res_users.py:13
high System graph security Trivy conf 1.00 CVE-2022-45198: Pillow 9.0.1 — requirements.txt
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GI ... Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Package: Pillow Installed: 9.0.1 Fixed in: 9.2.0 Severity: HIGH Fix: Upgrade Pillow to 9.2.0
VulnCve 2022 45198
high System graph security Trivy conf 1.00 CVE-2023-0286: cryptography 3.4.8 — requirements.txt
openssl: X.400 address type confusion in X.509 GeneralName There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of …
VulnCve 2023 0286
high System graph security Trivy conf 1.00 CVE-2023-25577: Werkzeug 2.0.2 — requirements.txt
python-werkzeug: high resource usage when parsing multipart form data with many fields Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount …
VulnCve 2023 25577
high System graph security Trivy conf 1.00 CVE-2023-25577: Werkzeug 2.2.2 — requirements.txt
python-werkzeug: high resource usage when parsing multipart form data with many fields Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount …
VulnCve 2023 25577
high System graph security Trivy conf 1.00 CVE-2023-33733: reportlab 3.6.12 — requirements.txt
python-reportlab: remote code execution via supplying a crafted PDF file Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Package: reportlab Installed: 3.6.12 Fixed in: 3.6.13 Severity: HIGH Fix: Upgrade reportlab to 3.6.13
VulnCve 2023 33733
high System graph security Trivy conf 1.00 CVE-2023-33733: reportlab 3.6.8 — requirements.txt
python-reportlab: remote code execution via supplying a crafted PDF file Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Package: reportlab Installed: 3.6.8 Fixed in: 3.6.13 Severity: HIGH Fix: Upgrade reportlab to 3.6.13
VulnCve 2023 33733
high System graph security Trivy conf 1.00 CVE-2023-43804: urllib3 1.26.5 — requirements.txt
python-urllib3: Cookie request header isn't stripped during cross-origin redirects urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. Howeve…
VulnCve 2023 43804
high System graph security Trivy conf 1.00 CVE-2023-44271: Pillow 9.0.1 — requirements.txt
python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash…
VulnCve 2023 44271
high System graph security Trivy conf 1.00 CVE-2023-44271: Pillow 9.4.0 — requirements.txt
python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash…
VulnCve 2023 44271
high System graph security Trivy conf 1.00 CVE-2023-4863: Pillow 9.0.1 — requirements.txt
libwebp: Heap buffer overflow in WebP Codec Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Package: Pillow Installed: 9.0.…
VulnCve 2023 4863
high System graph security Trivy conf 1.00 CVE-2023-4863: Pillow 9.4.0 — requirements.txt
libwebp: Heap buffer overflow in WebP Codec Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Package: Pillow Installed: 9.4.…
VulnCve 2023 4863
high System graph security Trivy conf 1.00 CVE-2023-50782: cryptography 3.4.8 — requirements.txt
python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659 A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to …
VulnCve 2023 50782
high System graph security Trivy conf 1.00 CVE-2024-28219: Pillow 10.2.0 — requirements.txt
python-pillow: buffer overflow in _imagingcms.c In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. Package: Pillow Installed: 10.2.0 Fixed in: 10.3.0 Severity: HIGH Fix: Upgrade Pillow to 10.3.0
VulnCve 2024 28219
high System graph security Trivy conf 1.00 CVE-2024-28219: Pillow 9.0.1 — requirements.txt
python-pillow: buffer overflow in _imagingcms.c In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. Package: Pillow Installed: 9.0.1 Fixed in: 10.3.0 Severity: HIGH Fix: Upgrade Pillow to 10.3.0
VulnCve 2024 28219
high System graph security Trivy conf 1.00 CVE-2024-28219: Pillow 9.4.0 — requirements.txt
python-pillow: buffer overflow in _imagingcms.c In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. Package: Pillow Installed: 9.4.0 Fixed in: 10.3.0 Severity: HIGH Fix: Upgrade Pillow to 10.3.0
VulnCve 2024 28219
high System graph security Trivy conf 1.00 CVE-2024-34069: Werkzeug 2.0.2 — requirements.txt
python-werkzeug: user may execute code on a developer's machine Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the dev…
VulnCve 2024 34069
high System graph security Trivy conf 1.00 CVE-2024-34069: Werkzeug 2.2.2 — requirements.txt
python-werkzeug: user may execute code on a developer's machine Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the dev…
VulnCve 2024 34069
high System graph security Trivy conf 1.00 CVE-2024-34069: Werkzeug 3.0.1 — requirements.txt
python-werkzeug: user may execute code on a developer's machine Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the dev…
VulnCve 2024 34069
high System graph security Trivy conf 1.00 CVE-2025-66418: urllib3 1.26.5 — requirements.txt
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimi…
VulnCve 2025 66418
high System graph security Trivy conf 1.00 CVE-2025-66418: urllib3 2.0.7 — requirements.txt
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimi…
VulnCve 2025 66418
high System graph security Trivy conf 1.00 CVE-2025-66471: urllib3 1.26.5 — requirements.txt
urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handlin…
VulnCve 2025 66471
high System graph security Trivy conf 1.00 CVE-2025-66471: urllib3 2.0.7 — requirements.txt
urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handlin…
VulnCve 2025 66471
high System graph security Trivy conf 1.00 CVE-2026-21441: urllib3 1.26.5 — requirements.txt
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loadin…
VulnCve 2026 21441
high System graph security Trivy conf 1.00 CVE-2026-21441: urllib3 2.0.7 — requirements.txt
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loadin…
VulnCve 2026 21441
high System graph security Trivy conf 1.00 CVE-2026-25990: Pillow 11.1.0 — requirements.txt
pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1. Package: Pillow Installed: 11.1.0 Fixed …
VulnCve 2026 25990
high System graph security Trivy conf 1.00 CVE-2026-26007: cryptography 3.4.8 — requirements.txt
cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticC…
VulnCve 2026 26007
high System graph security Trivy conf 1.00 CVE-2026-26007: cryptography 42.0.8 — requirements.txt
cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticC…
VulnCve 2026 26007
high System graph security Trivy conf 1.00 CVE-2026-26209: cbor2 5.4.2.post1 — requirements.txt
cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled r…
VulnCve 2026 26209
high System graph security Trivy conf 1.00 CVE-2026-26209: cbor2 5.4.6 — requirements.txt
cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled r…
VulnCve 2026 26209
high System graph security Trivy conf 1.00 CVE-2026-26209: cbor2 5.6.2 — requirements.txt
cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled r…
VulnCve 2026 26209
high System graph security Trivy conf 1.00 CVE-2026-27459: pyopenssl 24.1.0 — requirements.txt
pyOpenSSL: DTLS cookie callback buffer overflow pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow a…
VulnCve 2026 27459
high System graph security Trivy conf 1.00 CVE-2026-40192: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially c…
VulnCve 2026 40192
high System graph security Trivy conf 1.00 CVE-2026-40192: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially c…
VulnCve 2026 40192
high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 4.8.0 — requirements.txt
lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…
VulnCve 2026 41066
high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 4.9.3 — requirements.txt
lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…
VulnCve 2026 41066
high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 5.2.1 — requirements.txt
lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…
VulnCve 2026 41066
high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 5.4.0 — requirements.txt
lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…
VulnCve 2026 41066
high System graph security Trivy conf 1.00 CVE-2026-41066: lxml 6.0.2 — requirements.txt
lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input t…
VulnCve 2026 41066
high System graph security Trivy conf 1.00 CVE-2026-42311: Pillow 11.1.0 — requirements.txt
Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.…
VulnCve 2026 42311
high System graph security Trivy conf 1.00 CVE-2026-42311: Pillow 12.1.1 — requirements.txt
Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.…
VulnCve 2026 42311
high System graph security Trivy conf 1.00 CVE-2026-44431: urllib3 1.26.5 — requirements.txt
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fals…
VulnCve 2026 44431
high System graph security Trivy conf 1.00 CVE-2026-44431: urllib3 2.0.7 — requirements.txt
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fals…
VulnCve 2026 44431
high System graph security Trivy conf 1.00 CVE-2026-54058: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54058: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54058: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54058: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54058: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride small…
VulnCve 2026 54058
high System graph security Trivy conf 1.00 CVE-2026-54059: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54059: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54059: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54059: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54059: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted PCF font data Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_chec…
VulnCve 2026 54059
high System graph security Trivy conf 1.00 CVE-2026-54060: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-54060: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-54060: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-54060: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-54060: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._d…
VulnCve 2026 54060
high System graph security Trivy conf 1.00 CVE-2026-55379: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55379: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55379: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55379: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55379: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted BDF font file Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompressi…
VulnCve 2026 55379
high System graph security Trivy conf 1.00 CVE-2026-55380: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-55380: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-55380: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-55380: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-55380: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing …
VulnCve 2026 55380
high System graph security Trivy conf 1.00 CVE-2026-59197: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59197: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59197: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59197: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59197: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Native heap out-of-bounds write Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2…
VulnCve 2026 59197
high System graph security Trivy conf 1.00 CVE-2026-59199: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59199: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59199: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59199: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59199: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.…
VulnCve 2026 59199
high System graph security Trivy conf 1.00 CVE-2026-59200: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59200: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59200: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59200: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59200: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Denial of service via crafted PDF stream Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a c…
VulnCve 2026 59200
high System graph security Trivy conf 1.00 CVE-2026-59204: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59204: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59204: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59204: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59204: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 fi…
VulnCve 2026 59204
high System graph security Trivy conf 1.00 CVE-2026-59205: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59205: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59205: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59205: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59205: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode …
VulnCve 2026 59205
high System graph security Trivy conf 1.00 CVE-2026-59935: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with unterminated inline image pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causin…
VulnCve 2026 59935
high System graph security Trivy conf 1.00 CVE-2026-59936: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF inline image pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection …
VulnCve 2026 59936
high System graph api Wiring conf 0.90 Dangling fetch: CALL /web/dataset/call_kw/mail.push.device/register_devices (addons/mail/static/src/service_worker.js:311)
`addons/mail/static/src/service_worker.js:311` calls `CALL /web/dataset/call_kw/mail.push.device/register_devices` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path use…
addons/mail/static/src/service_worker.js:311 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: GET /iot_drivers/data (addons/iot_drivers/static/src/app/status.js:20)
`addons/iot_drivers/static/src/app/status.js:20` calls `GET /iot_drivers/data` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/iot_drivers/data`
addons/iot_drivers/static/src/app/status.js:20 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: GET /iot_drivers/iot_logs (addons/iot_drivers/static/src/app/logs.js:3)
`addons/iot_drivers/static/src/app/logs.js:3` calls `GET /iot_drivers/iot_logs` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/iot_drivers/iot_l…
addons/iot_drivers/static/src/app/logs.js:3 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: GET /web/bundle/${bundle} (addons/web/static/lib/hoot/ui/setup_hoot_ui.js:73)
`addons/web/static/lib/hoot/ui/setup_hoot_ui.js:73` calls `GET /web/bundle/${bundle}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/web/bundle/…
addons/web/static/lib/hoot/ui/setup_hoot_ui.js:73 Dangling fetchFetch
high System graph security Trivy conf 1.00 GHSA-537c-gmf6-5ccf: cryptography 3.4.8 — requirements.txt
Vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://o…
VulnGhsa 537c gmf6 5ccf
high System graph security Trivy conf 1.00 GHSA-537c-gmf6-5ccf: cryptography 42.0.8 — requirements.txt
Vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://o…
VulnGhsa 537c gmf6 5ccf
high System graph security security conf 1.00 Insecure pattern 'eval_used' in addons/partner_autocomplete/static/lib/jsvat.js:246
Found a known-risky pattern (eval_used). Review and replace if possible.
addons/partner_autocomplete/static/lib/jsvat.js:246 Eval used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in addons/html_builder/static/src/core/operation.js:40
Found a known-risky pattern (exec_used). Review and replace if possible.
addons/html_builder/static/src/core/operation.js:40 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in odoo/cli/shell.py:82
Found a known-risky pattern (exec_used). Review and replace if possible.
odoo/cli/shell.py:82 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in setup.py:10
Found a known-risky pattern (exec_used). Review and replace if possible.
setup.py:10 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in setup/package.py:31
Found a known-risky pattern (exec_used). Review and replace if possible.
setup/package.py:31 Exec used
high System graph security security conf 1.00 Insecure pattern 'new_function_used' in addons/html_editor/static/lib/diff2html/diff2html.min.js:1
Found a known-risky pattern (new_function_used). Review and replace if possible.
addons/html_editor/static/lib/diff2html/diff2html.min.js:1 New function used
high System graph security security conf 1.00 Insecure pattern 'new_function_used' in addons/web/static/lib/owl/owl.js:5857
Found a known-risky pattern (new_function_used). Review and replace if possible.
addons/web/static/lib/owl/owl.js:5857 New function used
high System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in addons/iot_drivers/tools/upgrade.py:205
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
addons/iot_drivers/tools/upgrade.py:205 Subprocess shell true
high System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in doc/cla/stats.py:29
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
doc/cla/stats.py:29 Subprocess shell true
high System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in odoo/service/server.py:1529
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
odoo/service/server.py:1529 Subprocess shell true
high System graph security security conf 1.00 Insecure pattern 'tls_verify_false' in odoo/cli/deploy.py:77
Found a known-risky pattern (tls_verify_false). Review and replace if possible.
odoo/cli/deploy.py:77 Tls verify false
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — addons/account_peppol/tools/private_key.pem
Trivy detected a possible secret in `addons/account_peppol/tools/private_key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment va…
Secret
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — addons/iot_box_image/overwrite_after_init/etc/ssl/private/nginx-cert.key
Trivy detected a possible secret in `addons/iot_box_image/overwrite_after_init/etc/ssl/private/nginx-cert.key`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secr…
Secret
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — addons/l10n_it_edi/data/pkey.key
Trivy detected a possible secret in `addons/l10n_it_edi/data/pkey.key`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment variables.
Secret
high System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 4.8.0: GHSA-vfmq-68hx-4jfw
OSV.dev reports `lxml` at version `4.8.0` (declared in `requirements.txt`) is affected by GHSA-vfmq-68hx-4jfw (aka CVE-2026-41066). lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files Aliases: CVE-2026-41066, PYSEC-2026-87 Advisory: https://osv.dev/vulnera…
requirements.txt ScaOsvGhsa vfmq 68hx 4jfw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 4.9.3: GHSA-vfmq-68hx-4jfw
OSV.dev reports `lxml` at version `4.9.3` (declared in `requirements.txt`) is affected by GHSA-vfmq-68hx-4jfw (aka CVE-2026-41066). lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files Aliases: CVE-2026-41066, PYSEC-2026-87 Advisory: https://osv.dev/vulnera…
requirements.txt ScaOsvGhsa vfmq 68hx 4jfw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 5.2.1: GHSA-vfmq-68hx-4jfw
OSV.dev reports `lxml` at version `5.2.1` (declared in `requirements.txt`) is affected by GHSA-vfmq-68hx-4jfw (aka CVE-2026-41066). lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files Aliases: CVE-2026-41066, PYSEC-2026-87 Advisory: https://osv.dev/vulnera…
requirements.txt ScaOsvGhsa vfmq 68hx 4jfw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 5.4.0: GHSA-vfmq-68hx-4jfw
OSV.dev reports `lxml` at version `5.4.0` (declared in `requirements.txt`) is affected by GHSA-vfmq-68hx-4jfw (aka CVE-2026-41066). lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files Aliases: CVE-2026-41066, PYSEC-2026-87 Advisory: https://osv.dev/vulnera…
requirements.txt ScaOsvGhsa vfmq 68hx 4jfw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw
OSV.dev reports `lxml` at version `6.0.2` (declared in `requirements.txt`) is affected by GHSA-vfmq-68hx-4jfw (aka CVE-2026-41066). lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files Aliases: CVE-2026-41066, PYSEC-2026-87 Advisory: https://osv.dev/vulnera…
requirements.txt ScaOsvGhsa vfmq 68hx 4jfw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-45hq-cxwh-f6vc
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading Aliases: BIT-pillow-2026-55379, CVE-202…
requirements.txt ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-5x94-69rx-g8h2
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSE…
requirements.txt ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-62p4-gmf7-7g93
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Aliases: BIT-pillow-2026-54058, CVE-2026-54058, PYSEC-2026…
requirements.txt ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-6r8x-57c9-28j4
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-6r8x-57c9-28j4 (aka CVE-2026-59199). Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow Aliases: BIT-pillow-2026-59199, CVE-2026-59199, PYSEC-2026-3451 A…
requirements.txt ScaOsvGhsa 6r8x 57c9 28j4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-8v84-f9pq-wr9x
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-8v84-f9pq-wr9x (aka CVE-2026-54059). Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading Aliases: BIT-…
requirements.txt ScaOsvGhsa 8v84 f9pq wr9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-9hw9-ch79-4vh6
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-9hw9-ch79-4vh6 (aka CVE-2026-59205). Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch Aliases: BIT-pillow-2026-59205, CVE-2026-59205, PYSEC-2…
requirements.txt ScaOsvGhsa 9hw9 ch79 4vh6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-jjj6-mw9f-p565
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-jjj6-mw9f-p565 (aka CVE-2026-59200). Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() Aliases: BIT-pillow-2026-59200, CVE-2026-59200, PYSEC-2026-3495 Advisory: https://osv.dev/vulnerab…
requirements.txt ScaOsvGhsa jjj6 mw9f p565
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-phj9-mv4w-65pm
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-phj9-mv4w-65pm (aka CVE-2026-55380). Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-55380, CVE-2026-55380, PYSEC-2026-2256 Advi…
requirements.txt ScaOsvGhsa phj9 mv4w 65pm
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-vjc4-5qp5-m44j
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-vjc4-5qp5-m44j (aka CVE-2026-59204). Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service Aliases: BIT-pillow-2026-59204, CVE-2026-59204, PYSEC-2026-349…
requirements.txt ScaOsvGhsa vjc4 5qp5 m44j
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-xj96-63gp-2gmr
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-xj96-63gp-2gmr (aka CVE-2026-59197). Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` Aliases: BIT-pillow-2026-59197, CVE-2026-59197, PYSEC-2026-34…
requirements.txt ScaOsvGhsa xj96 63gp 2gmr
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-45hq-cxwh-f6vc
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading Aliases: BIT-pillow-2026-55379, CVE-202…
requirements.txt ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-5x94-69rx-g8h2
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSE…
requirements.txt ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-62p4-gmf7-7g93
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Aliases: BIT-pillow-2026-54058, CVE-2026-54058, PYSEC-2026…
requirements.txt ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-6r8x-57c9-28j4
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-6r8x-57c9-28j4 (aka CVE-2026-59199). Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow Aliases: BIT-pillow-2026-59199, CVE-2026-59199, PYSEC-2026-3451 A…
requirements.txt ScaOsvGhsa 6r8x 57c9 28j4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-8v84-f9pq-wr9x
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-8v84-f9pq-wr9x (aka CVE-2026-54059). Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading Aliases: BIT-…
requirements.txt ScaOsvGhsa 8v84 f9pq wr9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-9hw9-ch79-4vh6
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-9hw9-ch79-4vh6 (aka CVE-2026-59205). Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch Aliases: BIT-pillow-2026-59205, CVE-2026-59205, PYSEC-2…
requirements.txt ScaOsvGhsa 9hw9 ch79 4vh6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-jjj6-mw9f-p565
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-jjj6-mw9f-p565 (aka CVE-2026-59200). Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() Aliases: BIT-pillow-2026-59200, CVE-2026-59200, PYSEC-2026-3495 Advisory: https://osv.dev/vulnerab…
requirements.txt ScaOsvGhsa jjj6 mw9f p565
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-phj9-mv4w-65pm
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-phj9-mv4w-65pm (aka CVE-2026-55380). Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-55380, CVE-2026-55380, PYSEC-2026-2256 Advi…
requirements.txt ScaOsvGhsa phj9 mv4w 65pm
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-vjc4-5qp5-m44j
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-vjc4-5qp5-m44j (aka CVE-2026-59204). Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service Aliases: BIT-pillow-2026-59204, CVE-2026-59204, PYSEC-2026-349…
requirements.txt ScaOsvGhsa vjc4 5qp5 m44j
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-xj96-63gp-2gmr
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-xj96-63gp-2gmr (aka CVE-2026-59197). Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` Aliases: BIT-pillow-2026-59197, CVE-2026-59197, PYSEC-2026-34…
requirements.txt ScaOsvGhsa xj96 63gp 2gmr
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-45hq-cxwh-f6vc
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading Aliases: BIT-pillow-2026-55379, CVE-202…
requirements.txt ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-5x94-69rx-g8h2
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSE…
requirements.txt ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-62p4-gmf7-7g93
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Aliases: BIT-pillow-2026-54058, CVE-2026-54058, PYSEC-2026…
requirements.txt ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-6r8x-57c9-28j4
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-6r8x-57c9-28j4 (aka CVE-2026-59199). Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow Aliases: BIT-pillow-2026-59199, CVE-2026-59199, PYSEC-2026-3451 A…
requirements.txt ScaOsvGhsa 6r8x 57c9 28j4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-8v84-f9pq-wr9x
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-8v84-f9pq-wr9x (aka CVE-2026-54059). Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading Aliases: BIT-…
requirements.txt ScaOsvGhsa 8v84 f9pq wr9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-9hw9-ch79-4vh6
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-9hw9-ch79-4vh6 (aka CVE-2026-59205). Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch Aliases: BIT-pillow-2026-59205, CVE-2026-59205, PYSEC-2…
requirements.txt ScaOsvGhsa 9hw9 ch79 4vh6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-jjj6-mw9f-p565
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-jjj6-mw9f-p565 (aka CVE-2026-59200). Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() Aliases: BIT-pillow-2026-59200, CVE-2026-59200, PYSEC-2026-3495 Advisory: https://osv.dev/vulnerab…
requirements.txt ScaOsvGhsa jjj6 mw9f p565
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-phj9-mv4w-65pm
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-phj9-mv4w-65pm (aka CVE-2026-55380). Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-55380, CVE-2026-55380, PYSEC-2026-2256 Advi…
requirements.txt ScaOsvGhsa phj9 mv4w 65pm
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-vjc4-5qp5-m44j
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-vjc4-5qp5-m44j (aka CVE-2026-59204). Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service Aliases: BIT-pillow-2026-59204, CVE-2026-59204, PYSEC-2026-349…
requirements.txt ScaOsvGhsa vjc4 5qp5 m44j
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-xj96-63gp-2gmr
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-xj96-63gp-2gmr (aka CVE-2026-59197). Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` Aliases: BIT-pillow-2026-59197, CVE-2026-59197, PYSEC-2026-34…
requirements.txt ScaOsvGhsa xj96 63gp 2gmr
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-45hq-cxwh-f6vc
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading Aliases: BIT-pillow-2026-55379, CVE-2026…
requirements.txt ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-5x94-69rx-g8h2
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSEC…
requirements.txt ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-62p4-gmf7-7g93
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Aliases: BIT-pillow-2026-54058, CVE-2026-54058, PYSEC-2026-…
requirements.txt ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-6r8x-57c9-28j4
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-6r8x-57c9-28j4 (aka CVE-2026-59199). Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow Aliases: BIT-pillow-2026-59199, CVE-2026-59199, PYSEC-2026-3451 Ad…
requirements.txt ScaOsvGhsa 6r8x 57c9 28j4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-8v84-f9pq-wr9x
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-8v84-f9pq-wr9x (aka CVE-2026-54059). Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading Aliases: BIT-p…
requirements.txt ScaOsvGhsa 8v84 f9pq wr9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-9hw9-ch79-4vh6
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-9hw9-ch79-4vh6 (aka CVE-2026-59205). Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch Aliases: BIT-pillow-2026-59205, CVE-2026-59205, PYSEC-20…
requirements.txt ScaOsvGhsa 9hw9 ch79 4vh6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-jjj6-mw9f-p565
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-jjj6-mw9f-p565 (aka CVE-2026-59200). Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() Aliases: BIT-pillow-2026-59200, CVE-2026-59200, PYSEC-2026-3495 Advisory: https://osv.dev/vulnerabi…
requirements.txt ScaOsvGhsa jjj6 mw9f p565
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-phj9-mv4w-65pm
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-phj9-mv4w-65pm (aka CVE-2026-55380). Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-55380, CVE-2026-55380, PYSEC-2026-2256 Advis…
requirements.txt ScaOsvGhsa phj9 mv4w 65pm
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-vjc4-5qp5-m44j
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-vjc4-5qp5-m44j (aka CVE-2026-59204). Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service Aliases: BIT-pillow-2026-59204, CVE-2026-59204, PYSEC-2026-3496…
requirements.txt ScaOsvGhsa vjc4 5qp5 m44j
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.0.1: GHSA-xj96-63gp-2gmr
OSV.dev reports `Pillow` at version `9.0.1` (declared in `requirements.txt`) is affected by GHSA-xj96-63gp-2gmr (aka CVE-2026-59197). Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` Aliases: BIT-pillow-2026-59197, CVE-2026-59197, PYSEC-2026-345…
requirements.txt ScaOsvGhsa xj96 63gp 2gmr
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-45hq-cxwh-f6vc
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379). Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading Aliases: BIT-pillow-2026-55379, CVE-2026…
requirements.txt ScaOsvGhsa 45hq cxwh f6vc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-5x94-69rx-g8h2
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-5x94-69rx-g8h2 (aka CVE-2026-54060). Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSEC…
requirements.txt ScaOsvGhsa 5x94 69rx g8h2
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-62p4-gmf7-7g93
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-62p4-gmf7-7g93 (aka CVE-2026-54058). Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Aliases: BIT-pillow-2026-54058, CVE-2026-54058, PYSEC-2026-…
requirements.txt ScaOsvGhsa 62p4 gmf7 7g93
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-6r8x-57c9-28j4
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-6r8x-57c9-28j4 (aka CVE-2026-59199). Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow Aliases: BIT-pillow-2026-59199, CVE-2026-59199, PYSEC-2026-3451 Ad…
requirements.txt ScaOsvGhsa 6r8x 57c9 28j4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-8v84-f9pq-wr9x
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-8v84-f9pq-wr9x (aka CVE-2026-54059). Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading Aliases: BIT-p…
requirements.txt ScaOsvGhsa 8v84 f9pq wr9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-9hw9-ch79-4vh6
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-9hw9-ch79-4vh6 (aka CVE-2026-59205). Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch Aliases: BIT-pillow-2026-59205, CVE-2026-59205, PYSEC-20…
requirements.txt ScaOsvGhsa 9hw9 ch79 4vh6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-jjj6-mw9f-p565
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-jjj6-mw9f-p565 (aka CVE-2026-59200). Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() Aliases: BIT-pillow-2026-59200, CVE-2026-59200, PYSEC-2026-3495 Advisory: https://osv.dev/vulnerabi…
requirements.txt ScaOsvGhsa jjj6 mw9f p565
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-phj9-mv4w-65pm
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-phj9-mv4w-65pm (aka CVE-2026-55380). Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()` Aliases: BIT-pillow-2026-55380, CVE-2026-55380, PYSEC-2026-2256 Advis…
requirements.txt ScaOsvGhsa phj9 mv4w 65pm
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-vjc4-5qp5-m44j
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-vjc4-5qp5-m44j (aka CVE-2026-59204). Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service Aliases: BIT-pillow-2026-59204, CVE-2026-59204, PYSEC-2026-3496…
requirements.txt ScaOsvGhsa vjc4 5qp5 m44j
high System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 9.4.0: GHSA-xj96-63gp-2gmr
OSV.dev reports `Pillow` at version `9.4.0` (declared in `requirements.txt`) is affected by GHSA-xj96-63gp-2gmr (aka CVE-2026-59197). Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` Aliases: BIT-pillow-2026-59197, CVE-2026-59197, PYSEC-2026-345…
requirements.txt ScaOsvGhsa xj96 63gp 2gmr
medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
low Security checks quality Error handling conf 1.00 [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.
Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.
addons/attachment_indexation/models/ir_attachment.py:81
medium Security checks quality Quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `_babel_extract_terms` (dict): `def _babel_extract_terms(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def _babel_extract_terms(x=None): x = x or []`
odoo/tools/translate.py:1436
medium Security checks software dependencies conf 0.90 ✓ Repobility 25 occurrences [MINED124] requirements.txt: `pytz # no version pinning to avoid OS perturbations` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins.
Replace `pytz # no version pinning to avoid OS perturbations` with `pytz # no version pinning to avoid OS perturbations==<version>` and manage upgrades through PRs / Dependabot.
2 files, 25 locations
setup/requirements-check.py:3, 4, 5, 6, 7, 9, 10, 11, +16 more (24 hits)
requirements.txt:79
medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.
Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …
addons/calendar/static/src/components/calendar_provider_config/calendar_connect_provider.js:57
low Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).
Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).
addons/im_livechat/static/src/embed/common/boot_helpers.js:54
low Security checks quality Error handling conf 0.55 ✓ Repobility 11 occurrences Broad exception handler needs review
This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.
7 files, 11 locations
odoo/tools/misc.py:943, 1505, 1560 (3 hits)
odoo/addons/base/models/ir_model.py:2268, 2564 (2 hits)
odoo/orm/registry.py:667, 725 (2 hits)
addons/iot_drivers/iot_handlers/drivers/serial_base_driver.py:101
odoo/addons/base/models/ir_actions.py:351
odoo/cli/start.py:58
odoo/tools/barcode.py:33
Error handlingquality
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.
.well-known/security.txt
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — addons/web/static/lib/fullcalendar/core/index.global.js:3027
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
addons/web/static/lib/fullcalendar/core/index.global.js:3027 Fq dangerous html
medium System graph security Analyzer error conf 1.00 Analyzer timeout: security.semgrep
analyzer exceeded 60.0s wall-clock (thread mode — daemon abandoned). Bump REPOBILITY_ANALYZER_TIMEOUT_S if expected.
Timeout
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2022-2309: lxml 4.8.0 — requirements.txt
lxml: NULL Pointer Dereference in lxml NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…
VulnCve 2022 2309
medium System graph security Trivy conf 1.00 CVE-2022-24859: PyPDF2 1.26.0 — requirements.txt
PyPDF2: infinite loop vulnerability PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the…
VulnCve 2022 24859
medium System graph security Trivy conf 1.00 CVE-2023-23931: cryptography 3.4.8 — requirements.txt
python-cryptography: memory corruption via immutable objects cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable…
VulnCve 2023 23931
medium System graph security Trivy conf 1.00 CVE-2023-32681: requests 2.25.1 — requirements.txt
python-requests: Unintended leak of Proxy-Authorization header Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Pro…
VulnCve 2023 32681
medium System graph security Trivy conf 1.00 CVE-2023-36464: PyPDF2 2.12.1 — requirements.txt
pypdf: Possible Infinite Loop when a comment isn't followed by a character pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracte…
VulnCve 2023 36464
medium System graph security Trivy conf 1.00 CVE-2023-36810: PyPDF2 1.26.0 — requirements.txt
pypdf is a pure-python PDF library capable of splitting, merging, crop ... pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadr…
VulnCve 2023 36810
medium System graph security Trivy conf 1.00 CVE-2023-45803: urllib3 1.26.5 — requirements.txt
urllib3: Request body not stripped after redirect from 303 status changes request method to GET urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its…
VulnCve 2023 45803
medium System graph security Trivy conf 1.00 CVE-2023-46136: Werkzeug 2.0.2 — requirements.txt
python-werkzeug: high resource consumption leading to denial of service Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of…
VulnCve 2023 46136
medium System graph security Trivy conf 1.00 CVE-2023-46136: Werkzeug 2.2.2 — requirements.txt
python-werkzeug: high resource consumption leading to denial of service Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of…
VulnCve 2023 46136
medium System graph security Trivy conf 1.00 CVE-2023-49083: cryptography 3.4.8 — requirements.txt
python-cryptography: NULL-dereference when loading PKCS7 certificates cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault…
VulnCve 2023 49083
medium System graph security Trivy conf 1.00 CVE-2024-0727: cryptography 3.4.8 — requirements.txt
openssl: denial of service via null dereference Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. …
VulnCve 2024 0727
medium System graph security Trivy conf 1.00 CVE-2024-22195: Jinja2 3.0.3 — requirements.txt
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potenti…
VulnCve 2024 22195
medium System graph security Trivy conf 1.00 CVE-2024-22195: Jinja2 3.1.2 — requirements.txt
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potenti…
VulnCve 2024 22195
medium System graph security Trivy conf 1.00 CVE-2024-34064: Jinja2 3.0.3 — requirements.txt
jinja2: accepts keys containing non-attribute characters Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as …
VulnCve 2024 34064
medium System graph security Trivy conf 1.00 CVE-2024-34064: Jinja2 3.1.2 — requirements.txt
jinja2: accepts keys containing non-attribute characters Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as …
VulnCve 2024 34064
medium System graph security Trivy conf 1.00 CVE-2024-35195: requests 2.25.1 — requirements.txt
requests: subsequent requests to the same host ignore cert verification Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will conti…
VulnCve 2024 35195
medium System graph security Trivy conf 1.00 CVE-2024-35195: requests 2.31.0 — requirements.txt
requests: subsequent requests to the same host ignore cert verification Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will conti…
VulnCve 2024 35195
medium System graph security Trivy conf 1.00 CVE-2024-3651: idna 2.10 — requirements.txt
python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,…
VulnCve 2024 3651
medium System graph security Trivy conf 1.00 CVE-2024-3651: idna 3.6 — requirements.txt
python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,…
VulnCve 2024 3651
medium System graph security Trivy conf 1.00 CVE-2024-37891: urllib3 1.26.5 — requirements.txt
urllib3: proxy-authorization request header is not stripped during cross-origin redirects urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, …
VulnCve 2024 37891
medium System graph security Trivy conf 1.00 CVE-2024-37891: urllib3 2.0.7 — requirements.txt
urllib3: proxy-authorization request header is not stripped during cross-origin redirects urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, …
VulnCve 2024 37891
medium System graph security Trivy conf 1.00 CVE-2024-47081: requests 2.25.1 — requirements.txt
requests: Requests vulnerable to .netrc credentials leak via malicious URLs Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receiv…
VulnCve 2024 47081
medium System graph security Trivy conf 1.00 CVE-2024-47081: requests 2.31.0 — requirements.txt
requests: Requests vulnerable to .netrc credentials leak via malicious URLs Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receiv…
VulnCve 2024 47081
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 2.0.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 2.2.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 3.0.1 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 2.0.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 2.2.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 3.0.1 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-56201: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja has a sandbox breakout through malicious filenames Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regard…
VulnCve 2024 56201
medium System graph security Trivy conf 1.00 CVE-2024-56201: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja has a sandbox breakout through malicious filenames Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regard…
VulnCve 2024 56201
medium System graph security Trivy conf 1.00 CVE-2024-56326: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja has a sandbox breakout through indirect reference to format method Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary…
VulnCve 2024 56326
medium System graph security Trivy conf 1.00 CVE-2024-56326: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja has a sandbox breakout through indirect reference to format method Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary…
VulnCve 2024 56326
medium System graph security Trivy conf 1.00 CVE-2025-27516: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja sandbox breakout through attr filter selecting format method Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary P…
VulnCve 2025 27516
medium System graph security Trivy conf 1.00 CVE-2025-27516: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja sandbox breakout through attr filter selecting format method Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary P…
VulnCve 2025 27516
medium System graph security Trivy conf 1.00 CVE-2025-50181: urllib3 1.26.5 — requirements.txt
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that dis…
VulnCve 2025 50181
medium System graph security Trivy conf 1.00 CVE-2025-50181: urllib3 2.0.7 — requirements.txt
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that dis…
VulnCve 2025 50181
medium System graph security Trivy conf 1.00 CVE-2025-55197: PyPDF 5.4.0 — requirements.txt
pypdf: PyPDF RAM Exhaustion Vulnerability pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-referen…
VulnCve 2025 55197
medium System graph security Trivy conf 1.00 CVE-2025-61911: python-ldap 3.4.0 — requirements.txt
python-ldap: sanitization bypass in ldap.filter.escape_filter_chars python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when …
VulnCve 2025 61911
medium System graph security Trivy conf 1.00 CVE-2025-61911: python-ldap 3.4.4 — requirements.txt
python-ldap: sanitization bypass in ldap.filter.escape_filter_chars python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when …
VulnCve 2025 61911
medium System graph security Trivy conf 1.00 CVE-2025-61912: python-ldap 3.4.0 — requirements.txt
python-ldap: python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash f…
VulnCve 2025 61912
medium System graph security Trivy conf 1.00 CVE-2025-61912: python-ldap 3.4.4 — requirements.txt
python-ldap: python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash f…
VulnCve 2025 61912
medium System graph security Trivy conf 1.00 CVE-2025-62707: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf affected by possible infinite loop when reading DCT inline images without EOF marker pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the cont…
VulnCve 2025 62707
medium System graph security Trivy conf 1.00 CVE-2025-62708: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf manipulated LZWDecode streams can exhaust RAM pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDec…
VulnCve 2025 62708
medium System graph security Trivy conf 1.00 CVE-2025-66019: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf manipulated LZWDecode streams can exhaust RAM pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a …
VulnCve 2025 66019
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 2.0.2 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 2.2.2 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 3.0.1 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.4.2.post1 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.4.6 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.6.2 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 2.0.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 2.2.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 3.0.1 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-24688: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf Infinite Loop when processing outlines/bookmarks pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outline…
VulnCve 2026 24688
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.25.1 — requirements.txt
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.31.0 — requirements.txt
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-27024: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with TreeObject outlines pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for examp…
VulnCve 2026 27024
medium System graph security Trivy conf 1.00 CVE-2026-27025: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large font values pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode en…
VulnCve 2026 27025
medium System graph security Trivy conf 1.00 CVE-2026-27026: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte…
VulnCve 2026 27026
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 2.0.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 2.2.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 3.0.1 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27888: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the correspo…
VulnCve 2026 27888
medium System graph security Trivy conf 1.00 CVE-2026-28351: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the…
VulnCve 2026 28351
medium System graph security Trivy conf 1.00 CVE-2026-28804: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHe…
VulnCve 2026 28804
medium System graph security Trivy conf 1.00 CVE-2026-31826: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rath…
VulnCve 2026 31826
medium System graph security Trivy conf 1.00 CVE-2026-33123: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing…
VulnCve 2026 33123
medium System graph security Trivy conf 1.00 CVE-2026-33699: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has b…
VulnCve 2026 33699
medium System graph security Trivy conf 1.00 CVE-2026-40260: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF whic…
VulnCve 2026 40260
medium System graph security Trivy conf 1.00 CVE-2026-41168: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with oversized streams pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong la…
VulnCve 2026 41168
medium System graph security Trivy conf 1.00 CVE-2026-41312: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires acce…
VulnCve 2026 41312
medium System graph security Trivy conf 1.00 CVE-2026-41313: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large tr…
VulnCve 2026 41313
medium System graph security Trivy conf 1.00 CVE-2026-41314: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large image sizes pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/…
VulnCve 2026 41314
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 10.2.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 11.1.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 12.1.1 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 9.0.1 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 9.4.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42309: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via specially crafted coordinate input Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw…
VulnCve 2026 42309
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 2.10 — requirements.txt
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.6 — requirements.txt
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-48155: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large character offsets pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large …
VulnCve 2026 48155
medium System graph security Trivy conf 1.00 CVE-2026-48156: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This …
VulnCve 2026 48156
medium System graph security Trivy conf 1.00 CVE-2026-48735: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots …
VulnCve 2026 48735
medium System graph security Trivy conf 1.00 CVE-2026-49460: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filte…
VulnCve 2026 49460
medium System graph security Trivy conf 1.00 CVE-2026-49461: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which …
VulnCve 2026 49461
medium System graph security Trivy conf 1.00 CVE-2026-54530: PyPDF 5.4.0 — requirements.txt
pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnera…
VulnCve 2026 54530
medium System graph security Trivy conf 1.00 CVE-2026-54531: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with outlines pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerabil…
VulnCve 2026 54531
medium System graph security Trivy conf 1.00 CVE-2026-54651: PyPDF 5.4.0 — requirements.txt
pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vu…
VulnCve 2026 54651
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198

Showing first 300 of 1173. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.