Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
158 of your 229 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 264.13s for a 1078.9 MB repo slow.
  • Repobility's analysis ran in 61.88s after the clone landed.

odoo/odoo

https://github.com/odoo/odoo.git · scanned 2026-07-27 15:03 UTC (23 hours, 12 minutes ago) · 10 languages

1731 raw signals (203 security + 1528 graph) 10/13 scanners ran 36th percentile · Python · huge (>500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 23 hours, 18 minutes ago · v3 · 1611 actionable findings from 2 signal sources. 120 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
74.9
/100
Security checks
77
83 findings
System graph
72
90.0% cov · 1528 findings
Critical
4
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 100.0 0.25 25.00
testing_score 82.0 0.20 16.40
documentation_score 82.0 0.15 12.30
practices_score 57.0 0.15 8.55
code_quality 55.0 0.10 5.50
Overall 1.00 76.8
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: severity: medium × excluding tests × Reset all
Severity: Critical 4 High 176 Medium 530 Low 470 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 83 System graph 1528 Crowd 0 Layer: Software 33 Quality 497 Security 311 Frontend 381 Network 1 Dependencies 383 Api 5
Scan summary Repository scanned at 72.4/100 with 90.0% coverage. It contains 96121 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 1528 findings — concentrated in quality (433), dependencies (383), frontend (381). Risk profile is high: 4 critical, 169 high, 525 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 523 of 1611 actionable findings. 1731 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them.
medium Security checks quality Quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `_babel_extract_terms` (dict): `def _babel_extract_terms(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.
Use None as the default and create the collection inside the function: `def _babel_extract_terms(x=None): x = x or []`
odoo/tools/translate.py:1436
medium Security checks software dependencies conf 0.90 ✓ Repobility 25 occurrences [MINED124] requirements.txt: `pytz # no version pinning to avoid OS perturbations` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins.
Replace `pytz # no version pinning to avoid OS perturbations` with `pytz # no version pinning to avoid OS perturbations==<version>` and manage upgrades through PRs / Dependabot.
2 files, 25 locations
setup/requirements-check.py:3, 4, 5, 6, 7, 9, 10, 11, +16 more (24 hits)
requirements.txt:79
medium Security checks software Open redirect conf 1.00 [SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If that endpoint is ever subverted (compromised admin, JSON injection, MITM on a webhook), users get redirected to a phishing site they trust because the original page is yours. CWE-601 (server-side OR client-side). Complement to server-side SEC030.
Validate the URL is same-origin or on an explicit allowlist before assignment: const u = new URL(serverUrl, location.href); if (u.origin !== location.origin && !ALLOWED.includes(u.host)) return; location.assign(u); Even better: have the server return a path (/checkout/done) instead of a full …
addons/calendar/static/src/components/calendar_provider_config/calendar_connect_provider.js:57
medium Security checks quality Quality conf 0.78 Public web service has no security.txt
Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.
.well-known/security.txt
medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — addons/web/static/lib/fullcalendar/core/index.global.js:3027
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
addons/web/static/lib/fullcalendar/core/index.global.js:3027 Fq dangerous html
medium System graph security Analyzer error conf 1.00 Analyzer timeout: security.semgrep
analyzer exceeded 60.0s wall-clock (thread mode — daemon abandoned). Bump REPOBILITY_ANALYZER_TIMEOUT_S if expected.
Timeout
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2022-2309: lxml 4.8.0 — requirements.txt
lxml: NULL Pointer Dereference in lxml NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…
VulnCve 2022 2309
medium System graph security Trivy conf 1.00 CVE-2022-24859: PyPDF2 1.26.0 — requirements.txt
PyPDF2: infinite loop vulnerability PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the…
VulnCve 2022 24859
medium System graph security Trivy conf 1.00 CVE-2023-23931: cryptography 3.4.8 — requirements.txt
python-cryptography: memory corruption via immutable objects cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable…
VulnCve 2023 23931
medium System graph security Trivy conf 1.00 CVE-2023-32681: requests 2.25.1 — requirements.txt
python-requests: Unintended leak of Proxy-Authorization header Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Pro…
VulnCve 2023 32681
medium System graph security Trivy conf 1.00 CVE-2023-36464: PyPDF2 2.12.1 — requirements.txt
pypdf: Possible Infinite Loop when a comment isn't followed by a character pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracte…
VulnCve 2023 36464
medium System graph security Trivy conf 1.00 CVE-2023-36810: PyPDF2 1.26.0 — requirements.txt
pypdf is a pure-python PDF library capable of splitting, merging, crop ... pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadr…
VulnCve 2023 36810
medium System graph security Trivy conf 1.00 CVE-2023-45803: urllib3 1.26.5 — requirements.txt
urllib3: Request body not stripped after redirect from 303 status changes request method to GET urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its…
VulnCve 2023 45803
medium System graph security Trivy conf 1.00 CVE-2023-46136: Werkzeug 2.0.2 — requirements.txt
python-werkzeug: high resource consumption leading to denial of service Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of…
VulnCve 2023 46136
medium System graph security Trivy conf 1.00 CVE-2023-46136: Werkzeug 2.2.2 — requirements.txt
python-werkzeug: high resource consumption leading to denial of service Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of…
VulnCve 2023 46136
medium System graph security Trivy conf 1.00 CVE-2023-49083: cryptography 3.4.8 — requirements.txt
python-cryptography: NULL-dereference when loading PKCS7 certificates cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault…
VulnCve 2023 49083
medium System graph security Trivy conf 1.00 CVE-2024-0727: cryptography 3.4.8 — requirements.txt
openssl: denial of service via null dereference Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. …
VulnCve 2024 0727
medium System graph security Trivy conf 1.00 CVE-2024-22195: Jinja2 3.0.3 — requirements.txt
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potenti…
VulnCve 2024 22195
medium System graph security Trivy conf 1.00 CVE-2024-22195: Jinja2 3.1.2 — requirements.txt
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potenti…
VulnCve 2024 22195
medium System graph security Trivy conf 1.00 CVE-2024-34064: Jinja2 3.0.3 — requirements.txt
jinja2: accepts keys containing non-attribute characters Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as …
VulnCve 2024 34064
medium System graph security Trivy conf 1.00 CVE-2024-34064: Jinja2 3.1.2 — requirements.txt
jinja2: accepts keys containing non-attribute characters Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as …
VulnCve 2024 34064
medium System graph security Trivy conf 1.00 CVE-2024-35195: requests 2.25.1 — requirements.txt
requests: subsequent requests to the same host ignore cert verification Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will conti…
VulnCve 2024 35195
medium System graph security Trivy conf 1.00 CVE-2024-35195: requests 2.31.0 — requirements.txt
requests: subsequent requests to the same host ignore cert verification Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will conti…
VulnCve 2024 35195
medium System graph security Trivy conf 1.00 CVE-2024-3651: idna 2.10 — requirements.txt
python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,…
VulnCve 2024 3651
medium System graph security Trivy conf 1.00 CVE-2024-3651: idna 3.6 — requirements.txt
python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,…
VulnCve 2024 3651
medium System graph security Trivy conf 1.00 CVE-2024-37891: urllib3 1.26.5 — requirements.txt
urllib3: proxy-authorization request header is not stripped during cross-origin redirects urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, …
VulnCve 2024 37891
medium System graph security Trivy conf 1.00 CVE-2024-37891: urllib3 2.0.7 — requirements.txt
urllib3: proxy-authorization request header is not stripped during cross-origin redirects urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, …
VulnCve 2024 37891
medium System graph security Trivy conf 1.00 CVE-2024-47081: requests 2.25.1 — requirements.txt
requests: Requests vulnerable to .netrc credentials leak via malicious URLs Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receiv…
VulnCve 2024 47081
medium System graph security Trivy conf 1.00 CVE-2024-47081: requests 2.31.0 — requirements.txt
requests: Requests vulnerable to .netrc credentials leak via malicious URLs Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receiv…
VulnCve 2024 47081
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 2.0.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 2.2.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49766: Werkzeug 3.0.1 — requirements.txt
werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path th…
VulnCve 2024 49766
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 2.0.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 2.2.2 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-49767: Werkzeug 3.0.1 — requirements.txt
werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/fo…
VulnCve 2024 49767
medium System graph security Trivy conf 1.00 CVE-2024-56201: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja has a sandbox breakout through malicious filenames Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regard…
VulnCve 2024 56201
medium System graph security Trivy conf 1.00 CVE-2024-56201: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja has a sandbox breakout through malicious filenames Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regard…
VulnCve 2024 56201
medium System graph security Trivy conf 1.00 CVE-2024-56326: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja has a sandbox breakout through indirect reference to format method Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary…
VulnCve 2024 56326
medium System graph security Trivy conf 1.00 CVE-2024-56326: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja has a sandbox breakout through indirect reference to format method Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary…
VulnCve 2024 56326
medium System graph security Trivy conf 1.00 CVE-2025-27516: Jinja2 3.0.3 — requirements.txt
jinja2: Jinja sandbox breakout through attr filter selecting format method Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary P…
VulnCve 2025 27516
medium System graph security Trivy conf 1.00 CVE-2025-27516: Jinja2 3.1.2 — requirements.txt
jinja2: Jinja sandbox breakout through attr filter selecting format method Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary P…
VulnCve 2025 27516
medium System graph security Trivy conf 1.00 CVE-2025-50181: urllib3 1.26.5 — requirements.txt
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that dis…
VulnCve 2025 50181
medium System graph security Trivy conf 1.00 CVE-2025-50181: urllib3 2.0.7 — requirements.txt
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that dis…
VulnCve 2025 50181
medium System graph security Trivy conf 1.00 CVE-2025-55197: PyPDF 5.4.0 — requirements.txt
pypdf: PyPDF RAM Exhaustion Vulnerability pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-referen…
VulnCve 2025 55197
medium System graph security Trivy conf 1.00 CVE-2025-61911: python-ldap 3.4.0 — requirements.txt
python-ldap: sanitization bypass in ldap.filter.escape_filter_chars python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when …
VulnCve 2025 61911
medium System graph security Trivy conf 1.00 CVE-2025-61911: python-ldap 3.4.4 — requirements.txt
python-ldap: sanitization bypass in ldap.filter.escape_filter_chars python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when …
VulnCve 2025 61911
medium System graph security Trivy conf 1.00 CVE-2025-61912: python-ldap 3.4.0 — requirements.txt
python-ldap: python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash f…
VulnCve 2025 61912
medium System graph security Trivy conf 1.00 CVE-2025-61912: python-ldap 3.4.4 — requirements.txt
python-ldap: python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash f…
VulnCve 2025 61912
medium System graph security Trivy conf 1.00 CVE-2025-62707: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf affected by possible infinite loop when reading DCT inline images without EOF marker pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the cont…
VulnCve 2025 62707
medium System graph security Trivy conf 1.00 CVE-2025-62708: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf manipulated LZWDecode streams can exhaust RAM pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDec…
VulnCve 2025 62708
medium System graph security Trivy conf 1.00 CVE-2025-66019: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf manipulated LZWDecode streams can exhaust RAM pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a …
VulnCve 2025 66019
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 2.0.2 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 2.2.2 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-66221: Werkzeug 3.0.1 — requirements.txt
Werkzeug: Werkzeug: Denial of service via Windows device names in path segments Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AU…
VulnCve 2025 66221
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.4.2.post1 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.4.6 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2025-68131: cbor2 5.6.2 — requirements.txt
cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple de…
VulnCve 2025 68131
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 2.0.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 2.2.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-21860: Werkzeug 3.0.1 — requirements.txt
Werkzeug safe_join() allows Windows special device names with compound extensions Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows…
VulnCve 2026 21860
medium System graph security Trivy conf 1.00 CVE-2026-24688: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf Infinite Loop when processing outlines/bookmarks pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outline…
VulnCve 2026 24688
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.25.1 — requirements.txt
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.31.0 — requirements.txt
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-27024: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with TreeObject outlines pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for examp…
VulnCve 2026 27024
medium System graph security Trivy conf 1.00 CVE-2026-27025: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large font values pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode en…
VulnCve 2026 27025
medium System graph security Trivy conf 1.00 CVE-2026-27026: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via malformed PDF /FlateDecode stream pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte…
VulnCve 2026 27026
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 2.0.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 2.2.2 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27199: Werkzeug 3.0.1 — requirements.txt
Werkzeug safe_join() allows Windows special device names Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but…
VulnCve 2026 27199
medium System graph security Trivy conf 1.00 CVE-2026-27888: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the correspo…
VulnCve 2026 27888
medium System graph security Trivy conf 1.00 CVE-2026-28351: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the…
VulnCve 2026 28351
medium System graph security Trivy conf 1.00 CVE-2026-28804: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHe…
VulnCve 2026 28804
medium System graph security Trivy conf 1.00 CVE-2026-31826: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rath…
VulnCve 2026 31826
medium System graph security Trivy conf 1.00 CVE-2026-33123: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing…
VulnCve 2026 33123
medium System graph security Trivy conf 1.00 CVE-2026-33699: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has b…
VulnCve 2026 33699
medium System graph security Trivy conf 1.00 CVE-2026-40260: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF whic…
VulnCve 2026 40260
medium System graph security Trivy conf 1.00 CVE-2026-41168: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with oversized streams pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong la…
VulnCve 2026 41168
medium System graph security Trivy conf 1.00 CVE-2026-41312: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires acce…
VulnCve 2026 41312
medium System graph security Trivy conf 1.00 CVE-2026-41313: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large tr…
VulnCve 2026 41313
medium System graph security Trivy conf 1.00 CVE-2026-41314: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large image sizes pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/…
VulnCve 2026 41314
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 10.2.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 11.1.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 12.1.1 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 9.0.1 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42308: Pillow 9.4.0 — requirements.txt
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42309: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via specially crafted coordinate input Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw…
VulnCve 2026 42309
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-42310: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 2.10 — requirements.txt
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.6 — requirements.txt
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-48155: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large character offsets pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large …
VulnCve 2026 48155
medium System graph security Trivy conf 1.00 CVE-2026-48156: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This …
VulnCve 2026 48156
medium System graph security Trivy conf 1.00 CVE-2026-48735: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots …
VulnCve 2026 48735
medium System graph security Trivy conf 1.00 CVE-2026-49460: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filte…
VulnCve 2026 49460
medium System graph security Trivy conf 1.00 CVE-2026-49461: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which …
VulnCve 2026 49461
medium System graph security Trivy conf 1.00 CVE-2026-54530: PyPDF 5.4.0 — requirements.txt
pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnera…
VulnCve 2026 54530
medium System graph security Trivy conf 1.00 CVE-2026-54531: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with outlines pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerabil…
VulnCve 2026 54531
medium System graph security Trivy conf 1.00 CVE-2026-54651: PyPDF 5.4.0 — requirements.txt
pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vu…
VulnCve 2026 54651
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 10.2.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 11.1.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 12.1.1 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 9.0.1 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-55798: Pillow 9.4.0 — requirements.txt
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 10.2.0 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 11.1.0 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 9.0.1 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59198: Pillow 9.4.0 — requirements.txt
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59203: Pillow 12.1.1 — requirements.txt
Pillow: Pillow: Denial of Service via crafted EPS file Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to t…
VulnCve 2026 59203
medium System graph security Trivy conf 1.00 CVE-2026-59937: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Denial of Service via crafted PDF with malformed cross-reference streams pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cro…
VulnCve 2026 59937
medium System graph security Trivy conf 1.00 CVE-2026-59938: PyPDF 5.4.0 — requirements.txt
pypdf: pypdf: Possible large memory usage for wrong image dimensions pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image …
VulnCve 2026 59938
medium System graph dependencies dependencies conf 0.90 Dependency chardet is two or more major versions behind
`chardet` is pinned at `4.0.0` in `requirements.txt` while the latest release on the pypi registry is `7.4.3` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `chardet` to `7.4.3`.
requirements.txt FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency cryptography is two or more major versions behind
`cryptography` is pinned at `3.4.8` in `requirements.txt` while the latest release on the pypi registry is `49.0.0` — 46 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `cryptography` to `49…
requirements.txt FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency geoip2 is two or more major versions behind
`geoip2` is pinned at `2.9.0` in `requirements.txt` while the latest release on the pypi registry is `5.3.0` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `geoip2` to `5.3.0`.
requirements.txt FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency gevent is two or more major versions behind
`gevent` is pinned at `21.8.0` in `requirements.txt` while the latest release on the pypi registry is `26.7.0` — 5 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `gevent` to `26.7.0`.
requirements.txt FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency greenlet is two or more major versions behind
`greenlet` is pinned at `1.1.2` in `requirements.txt` while the latest release on the pypi registry is `3.5.4` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `greenlet` to `3.5.4`.
requirements.txt FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency lxml is two or more major versions behind
`lxml` is pinned at `4.8.0` in `requirements.txt` while the latest release on the pypi registry is `6.1.1` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lxml` to `6.1.1`.
requirements.txt FreshnessOutdated
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/html_editor/static/src/utils/image_processing.js:59
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/html_editor/static/src/utils/image_processing.js:59 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/mail/static/src/service_worker.js:190
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/mail/static/src/service_worker.js:190 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/web/static/lib/fullcalendar/core/index.global.js:8550
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/web/static/lib/fullcalendar/core/index.global.js:8550 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/web/static/src/service_worker.js:14
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/web/static/src/service_worker.js:14 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/web_unsplash/static/src/frontend/unsplash_beacon.js:27
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/web_unsplash/static/src/frontend/unsplash_beacon.js:27 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/website/static/src/interactions/image_shape_hover_effect.js:51
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/website/static/src/interactions/image_shape_hover_effect.js:51 runtime safetyRobustnessUnhandled promise
medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — addons/website/static/src/js/utils.js:24
This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.
addons/website/static/src/js/utils.js:24 runtime safetyRobustnessUnhandled promise
medium System graph security Trivy conf 1.00 GHSA-4cc2-g9w2-fhf6: zeep 4.1.0 — requirements.txt
Zeep: Server-Side Request Forgery (SSRF) ## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution — and will fetch http/https URLs found in those references. The Settings.forbid_external option…
VulnGhsa 4cc2 g9w2 fhf6
medium System graph security Trivy conf 1.00 GHSA-4cc2-g9w2-fhf6: zeep 4.2.1 — requirements.txt
Zeep: Server-Side Request Forgery (SSRF) ## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution — and will fetch http/https URLs found in those references. The Settings.forbid_external option…
VulnGhsa 4cc2 g9w2 fhf6
medium System graph security Trivy conf 1.00 GHSA-4cc2-g9w2-fhf6: zeep 4.3.1 — requirements.txt
Zeep: Server-Side Request Forgery (SSRF) ## Summary When parsing a WSDL or XSD document, python-zeep follows transitive references — xsd:import, xsd:include, wsdl:import, and lxml entity/DTD resolution — and will fetch http/https URLs found in those references. The Settings.forbid_external option…
VulnGhsa 4cc2 g9w2 fhf6
medium System graph security Trivy conf 1.00 GHSA-h4gh-qq45-vh27: cryptography 42.0.8 — requirements.txt
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be f…
VulnGhsa h4gh qq45 vh27
medium System graph security Trivy conf 1.00 GHSA-jm82-fx9c-mx94: PyPDF 5.4.0 — requirements.txt
pypdf: Missing stream length values ignore defined limits ### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value. ### Patches This…
VulnGhsa jm82 fx9c mx94
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in addons/web/static/lib/fullcalendar/core/index.global.js:3027
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
addons/web/static/lib/fullcalendar/core/index.global.js:3027 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/components/html_viewer/html_viewer.js:200
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/components/html_viewer/html_viewer.js:200 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/core/clipboard_plugin.js:473
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/core/clipboard_plugin.js:473 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/fields/html_field.js:251
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/fields/html_field.js:251 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/others/collaboration/collaboration_odoo_plugin.js:601
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/others/collaboration/collaboration_odoo_plugin.js:601 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/others/embedded_components/core/syntax_highlighting/syntax_highlighting_utils.js:80
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/others/embedded_components/core/syntax_highlighting/syntax_highlighting_utils.js:80 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/html_editor/static/src/public/html_migrations/html_migrations_interaction.js:47
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/html_editor/static/src/public/html_migrations/html_migrations_interaction.js:47 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/mail/static/src/core/common/message_model.js:559
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/mail/static/src/core/common/message_model.js:559 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/payment/static/src/interactions/payment_form.js:489
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/payment/static/src/interactions/payment_form.js:489 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/point_of_sale/static/src/app/utils/html-to-image.js:505
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/point_of_sale/static/src/app/utils/html-to-image.js:505 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/lib/dompurify/DOMpurify.js:914
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/lib/dompurify/DOMpurify.js:914 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/lib/owl/owl.js:1463
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/lib/owl/owl.js:1463 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/lib/pdfjs/web/viewer.js:2394
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/lib/pdfjs/web/viewer.js:2394 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/lib/prismjs/prism.js:592
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/lib/prismjs/prism.js:592 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/lib/qunit/qunit-2.9.1.js:4464
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/lib/qunit/qunit-2.9.1.js:4464 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/src/core/utils/html.js:256
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/src/core/utils/html.js:256 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/web/static/src/public/colibri.js:187
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/web/static/src/public/colibri.js:187 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/website/static/src/builder/plugins/translation_plugin.js:368
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/website/static/src/builder/plugins/translation_plugin.js:368 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/website_google_map/static/src/lib/markerclusterer.js:1073
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/website_google_map/static/src/lib/markerclusterer.js:1073 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/website_sale/static/src/interactions/checkout.js:91
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/website_sale/static/src/interactions/checkout.js:91 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/website_sale/static/src/js/website_sale_utils.js:117
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/website_sale/static/src/js/website_sale_utils.js:117 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in addons/website_sale_loyalty/static/src/interactions/checkout.js:16
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
addons/website_sale_loyalty/static/src/interactions/checkout.js:16 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_outerhtml_assignment' in addons/website_slides/static/src/interactions/course_page.js:68
Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible.
addons/website_slides/static/src/interactions/course_page.js:68 Direct outerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/html_builder/static/src/plugins/many2one_option_plugin.js:71
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/html_builder/static/src/plugins/many2one_option_plugin.js:71 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/html_builder/static/src/snippets/snippet_service.js:154
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/html_builder/static/src/snippets/snippet_service.js:154 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/html_editor/static/src/fields/html_field.js:46
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/html_editor/static/src/fields/html_field.js:46 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/html_editor/static/src/main/link/link_plugin.js:96
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/html_editor/static/src/main/link/link_plugin.js:96 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/html_editor/static/src/utils/html.js:9
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/html_editor/static/src/utils/html.js:9 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/survey/static/src/interactions/survey_form.js:353
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/survey/static/src/interactions/survey_form.js:353 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/survey/static/src/interactions/survey_session_leaderboard.js:132
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/survey/static/src/interactions/survey_session_leaderboard.js:132 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/survey/static/src/interactions/survey_session_manage.js:429
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/survey/static/src/interactions/survey_session_manage.js:429 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/web/static/src/core/file_upload/file_upload_service.js:95
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/web/static/src/core/file_upload/file_upload_service.js:95 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/web/static/src/core/network/download.js:544
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/web/static/src/core/network/download.js:544 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/web/static/src/webclient/debug/profiling/profiling_qweb.js:304
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/web/static/src/webclient/debug/profiling/profiling_qweb.js:304 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/website/static/src/builder/plugins/translation_plugin.js:340
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website/static/src/builder/plugins/translation_plugin.js:340 Domparser html parse
medium System graph security security conf 0.85 Insecure pattern 'domparser_html_parse' in addons/website/static/src/client_actions/website_preview/edit_website_systray_item.js:116
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website/static/src/client_actions/website_preview/edit_website_systray_item.js:116 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/website/static/src/components/dialog/add_page_dialog.js:191
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website/static/src/components/dialog/add_page_dialog.js:191 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/website/static/src/js/utils.js:28
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website/static/src/js/utils.js:28 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/website_event/static/src/interactions/website_event_slot_details.js:108
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website_event/static/src/interactions/website_event_slot_details.js:108 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in addons/website_event/static/src/interactions/website_event_ticket_details.js:90
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
addons/website_event/static/src/interactions/website_event_ticket_details.js:90 Domparser html parse
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in addons/hr_homeworking_calendar/static/src/calendar/common/calendar_common_renderer.js:88
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
addons/hr_homeworking_calendar/static/src/calendar/common/calendar_common_renderer.js:88 Insert adjacent html
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in addons/website_sale/static/src/interactions/website_sale.js:269
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
addons/website_sale/static/src/interactions/website_sale.js:269 Insert adjacent html
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in addons/website_sale/static/src/js/variant_mixin.js:375
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
addons/website_sale/static/src/js/variant_mixin.js:375 Insert adjacent html
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in addons/website_sale/static/src/js/website_sale_utils.js:132
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
addons/website_sale/static/src/js/website_sale_utils.js:132 Insert adjacent html
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in addons/auth_passkey/_vendor/webauthn/helpers/algorithms.py:10
Found a known-risky pattern (weak_hash). Review and replace if possible.
addons/auth_passkey/_vendor/webauthn/helpers/algorithms.py:10 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in addons/auth_passkey/_vendor/webauthn/helpers/tpm/structs.py:44
Found a known-risky pattern (weak_hash). Review and replace if possible.
addons/auth_passkey/_vendor/webauthn/helpers/tpm/structs.py:44 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in addons/certificate/models/key.py:13
Found a known-risky pattern (weak_hash). Review and replace if possible.
addons/certificate/models/key.py:13 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in addons/cloud_storage_google/utils/cloud_storage_google_utils.py:222
Found a known-risky pattern (weak_hash). Review and replace if possible.
addons/cloud_storage_google/utils/cloud_storage_google_utils.py:222 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in addons/payment_asiapay/models/payment_provider.py:41
Found a known-risky pattern (weak_hash). Review and replace if possible.
addons/payment_asiapay/models/payment_provider.py:41 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in odoo/addons/base/models/ir_attachment.py:476
Found a known-risky pattern (weak_hash). Review and replace if possible.
odoo/addons/base/models/ir_attachment.py:476 Weak hash
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/google_gmail/models/google_gmail_mixin.py:185
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/google_gmail/models/google_gmail_mixin.py:185 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/html_editor/controllers/main.py:518
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/html_editor/controllers/main.py:518 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/browser.py:92
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/browser.py:92 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/iot_handlers/drivers/display_driver_L.py:129
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/iot_handlers/drivers/display_driver_L.py:129 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/iot_handlers/drivers/keyboard_usb_driver_L.py:178
`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/iot_handlers/drivers/keyboard_usb_driver_L.py:178 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/iot_handlers/interfaces/display_interface_L.py:17
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/iot_handlers/interfaces/display_interface_L.py:17 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/main.py:137
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/main.py:137 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/tools/helpers.py:219
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/tools/helpers.py:219 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/tools/upgrade.py:29
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/tools/upgrade.py:29 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/iot_drivers/tools/wifi.py:36
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/iot_drivers/tools/wifi.py:36 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/microsoft_outlook/models/microsoft_outlook_mixin.py:183
`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/microsoft_outlook/models/microsoft_outlook_mixin.py:183 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — addons/web_unsplash/controllers/main.py:37
`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
addons/web_unsplash/controllers/main.py:37 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — odoo/addons/base/models/ir_actions_report.py:49
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
odoo/addons/base/models/ir_actions_report.py:49 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — odoo/service/db.py:299
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
odoo/service/db.py:299 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — odoo/service/server.py:1529
`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
odoo/service/server.py:1529 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — setup/package.py:122
`subprocess.call(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
setup/package.py:122 runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 832 placeholder/mock markers across 331 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Secrets conf 0.58 Possible secret in addons/mail/static/lib/odoo_sfu/odoo_sfu.js
Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager.
addons/mail/static/lib/odoo_sfu/odoo_sfu.js:12752 Password literal
medium System graph network Security conf 1.00 Privileged port 993 in use
Port 993 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
addons/google_gmail/models/fetchmail_server.py Ports
medium System graph dependencies dependencies conf 1.00 Proxy-Authorization leak in requests <2.31.0 ([email protected])
Package `requests` at declared version `2.25.1` matches a known-vulnerable release (CVE: CVE-2023-32681). Upgrade to a patched version per the upstream advisory. This is an embedded trip-wire — run the trivy adapter or OSV / Snyk / Dependabot for comprehensive coverage.
requirements.txt CveCve 2023 32681Cwe 200
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: GHSA-3c37-wwvx-h642
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by GHSA-3c37-wwvx-h642. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3c37-wwvx-h642 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 3c37 wwvx h642
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: GHSA-wcj4-jw5j-44wh
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by GHSA-wcj4-jw5j-44wh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wcj4-jw5j-44wh Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa wcj4 jw5j 44wh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: PYSEC-2024-155
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by PYSEC-2024-155. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2024-155 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2024 155
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: PYSEC-2025-238
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by PYSEC-2025-238. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-238 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 238
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: PYSEC-2025-90
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by PYSEC-2025-90. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-90 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 90
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.2.post1: PYSEC-2026-2123
OSV.dev reports `cbor2` at version `5.4.2.post1` (declared in `requirements.txt`) is affected by PYSEC-2026-2123. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2123 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2123
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: GHSA-3c37-wwvx-h642
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by GHSA-3c37-wwvx-h642. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3c37-wwvx-h642 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 3c37 wwvx h642
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: GHSA-wcj4-jw5j-44wh
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by GHSA-wcj4-jw5j-44wh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wcj4-jw5j-44wh Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa wcj4 jw5j 44wh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: PYSEC-2024-155
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by PYSEC-2024-155. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2024-155 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2024 155
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: PYSEC-2025-238
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by PYSEC-2025-238. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-238 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 238
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: PYSEC-2025-90
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by PYSEC-2025-90. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-90 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 90
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.4.6: PYSEC-2026-2123
OSV.dev reports `cbor2` at version `5.4.6` (declared in `requirements.txt`) is affected by PYSEC-2026-2123. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2123 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2123
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.6.2: GHSA-3c37-wwvx-h642
OSV.dev reports `cbor2` at version `5.6.2` (declared in `requirements.txt`) is affected by GHSA-3c37-wwvx-h642. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3c37-wwvx-h642 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 3c37 wwvx h642
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.6.2: GHSA-wcj4-jw5j-44wh
OSV.dev reports `cbor2` at version `5.6.2` (declared in `requirements.txt`) is affected by GHSA-wcj4-jw5j-44wh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wcj4-jw5j-44wh Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa wcj4 jw5j 44wh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.6.2: PYSEC-2025-238
OSV.dev reports `cbor2` at version `5.6.2` (declared in `requirements.txt`) is affected by PYSEC-2025-238. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-238 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 238
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.6.2: PYSEC-2025-90
OSV.dev reports `cbor2` at version `5.6.2` (declared in `requirements.txt`) is affected by PYSEC-2025-90. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2025-90 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2025 90
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cbor2 5.6.2: PYSEC-2026-2123
OSV.dev reports `cbor2` at version `5.6.2` (declared in `requirements.txt`) is affected by PYSEC-2026-2123. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2123 Fix: upgrade `cbor2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2123
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-3ww4-gg4f-jr7f
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-3ww4-gg4f-jr7f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3ww4-gg4f-jr7f Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 3ww4 gg4f jr7f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-537c-gmf6-5ccf
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-537c-gmf6-5ccf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 537c gmf6 5ccf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-5cpq-8wj7-hf2v
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-5cpq-8wj7-hf2v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5cpq-8wj7-hf2v Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 5cpq 8wj7 hf2v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-9v9h-cgj8-h64p
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-9v9h-cgj8-h64p. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9v9h-cgj8-h64p Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 9v9h cgj8 h64p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-jfhm-5ghh-2f97
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-jfhm-5ghh-2f97. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jfhm-5ghh-2f97 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa jfhm 5ghh 2f97
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-jm77-qphf-c4w8
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-jm77-qphf-c4w8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jm77-qphf-c4w8 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa jm77 qphf c4w8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-m959-cc7f-wv43
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-m959-cc7f-wv43. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m959-cc7f-wv43 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa m959 cc7f wv43
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-r6ph-v2qm-q3c2
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-r6ph-v2qm-q3c2. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r6ph-v2qm-q3c2 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa r6ph v2qm q3c2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-v8gr-m533-ghj9
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-v8gr-m533-ghj9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v8gr-m533-ghj9 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa v8gr m533 ghj9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-w7pp-m8wf-vj6r
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-w7pp-m8wf-vj6r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa w7pp m8wf vj6r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: GHSA-x4qr-2fvf-3mr5
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by GHSA-x4qr-2fvf-3mr5. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa x4qr 2fvf 3mr5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2023-11
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2023-11. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2023-11 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2023 11
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2023-254
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2023-254. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2023-254 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2023 254
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2026-1283
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2026-1283. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1283 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1283
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2026-1285
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2026-1285. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1285 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1285
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2026-2141
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2026-2141. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2141 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2141
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2026-35
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2026-35. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-35 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 35
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 3.4.8: PYSEC-2026-800
OSV.dev reports `cryptography` at version `3.4.8` (declared in `requirements.txt`) is affected by PYSEC-2026-800. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-800 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 800
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: GHSA-537c-gmf6-5ccf
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by GHSA-537c-gmf6-5ccf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 537c gmf6 5ccf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: GHSA-79v4-65xg-pq4g
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by GHSA-79v4-65xg-pq4g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-79v4-65xg-pq4g Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 79v4 65xg pq4g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: GHSA-h4gh-qq45-vh27
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by GHSA-h4gh-qq45-vh27. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h4gh-qq45-vh27 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa h4gh qq45 vh27
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: GHSA-m959-cc7f-wv43
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by GHSA-m959-cc7f-wv43. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m959-cc7f-wv43 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa m959 cc7f wv43
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: GHSA-r6ph-v2qm-q3c2
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by GHSA-r6ph-v2qm-q3c2. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r6ph-v2qm-q3c2 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvGhsa r6ph v2qm q3c2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: PYSEC-2026-1284
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by PYSEC-2026-1284. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1284 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1284
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: PYSEC-2026-2141
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by PYSEC-2026-2141. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2141 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2141
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency cryptography 42.0.8: PYSEC-2026-35
OSV.dev reports `cryptography` at version `42.0.8` (declared in `requirements.txt`) is affected by PYSEC-2026-35. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-35 Fix: upgrade `cryptography` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 35
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency gevent 21.8.0: GHSA-x7m3-jprg-wc5g
OSV.dev reports `gevent` at version `21.8.0` (declared in `requirements.txt`) is affected by GHSA-x7m3-jprg-wc5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x7m3-jprg-wc5g Fix: upgrade `gevent` past the affected range per the advisory.
requirements.txt ScaOsvGhsa x7m3 jprg wc5g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency gevent 21.8.0: PYSEC-2023-177
OSV.dev reports `gevent` at version `21.8.0` (declared in `requirements.txt`) is affected by PYSEC-2023-177. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2023-177 Fix: upgrade `gevent` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2023 177
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency gevent 22.10.2: GHSA-x7m3-jprg-wc5g
OSV.dev reports `gevent` at version `22.10.2` (declared in `requirements.txt`) is affected by GHSA-x7m3-jprg-wc5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x7m3-jprg-wc5g Fix: upgrade `gevent` past the affected range per the advisory.
requirements.txt ScaOsvGhsa x7m3 jprg wc5g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency gevent 22.10.2: PYSEC-2023-177
OSV.dev reports `gevent` at version `22.10.2` (declared in `requirements.txt`) is affected by PYSEC-2023-177. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2023-177 Fix: upgrade `gevent` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2023 177
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 2.10: GHSA-65pc-fj4g-8rjx
OSV.dev reports `idna` at version `2.10` (declared in `requirements.txt`) is affected by GHSA-65pc-fj4g-8rjx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 65pc fj4g 8rjx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 2.10: GHSA-jjg7-2v4v-x38h
OSV.dev reports `idna` at version `2.10` (declared in `requirements.txt`) is affected by GHSA-jjg7-2v4v-x38h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jjg7-2v4v-x38h Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvGhsa jjg7 2v4v x38h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 2.10: PYSEC-2024-60
OSV.dev reports `idna` at version `2.10` (declared in `requirements.txt`) is affected by PYSEC-2024-60. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2024-60 Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2024 60
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 2.10: PYSEC-2026-215
OSV.dev reports `idna` at version `2.10` (declared in `requirements.txt`) is affected by PYSEC-2026-215. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-215 Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 215
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 3.6: GHSA-65pc-fj4g-8rjx
OSV.dev reports `idna` at version `3.6` (declared in `requirements.txt`) is affected by GHSA-65pc-fj4g-8rjx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 65pc fj4g 8rjx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 3.6: GHSA-jjg7-2v4v-x38h
OSV.dev reports `idna` at version `3.6` (declared in `requirements.txt`) is affected by GHSA-jjg7-2v4v-x38h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jjg7-2v4v-x38h Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvGhsa jjg7 2v4v x38h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 3.6: PYSEC-2024-60
OSV.dev reports `idna` at version `3.6` (declared in `requirements.txt`) is affected by PYSEC-2024-60. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2024-60 Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2024 60
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency idna 3.6: PYSEC-2026-215
OSV.dev reports `idna` at version `3.6` (declared in `requirements.txt`) is affected by PYSEC-2026-215. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-215 Fix: upgrade `idna` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 215
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: GHSA-cpwx-vrp4-4pq7
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by GHSA-cpwx-vrp4-4pq7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa cpwx vrp4 4pq7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: GHSA-gmj6-6f8f-6699
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by GHSA-gmj6-6f8f-6699. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gmj6-6f8f-6699 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa gmj6 6f8f 6699
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: GHSA-h5c8-rqwp-cp95
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by GHSA-h5c8-rqwp-cp95. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h5c8-rqwp-cp95 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa h5c8 rqwp cp95
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: GHSA-h75v-3vvj-5mfj
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by GHSA-h75v-3vvj-5mfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h75v-3vvj-5mfj Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa h75v 3vvj 5mfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: GHSA-q2x7-8rv6-6q7h
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by GHSA-q2x7-8rv6-6q7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q2x7-8rv6-6q7h Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa q2x7 8rv6 6q7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: PYSEC-2026-1471
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by PYSEC-2026-1471. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1471 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1471
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: PYSEC-2026-1472
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by PYSEC-2026-1472. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1472 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1472
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: PYSEC-2026-1473
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by PYSEC-2026-1473. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1473 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1473
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: PYSEC-2026-1474
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by PYSEC-2026-1474. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1474 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1474
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.0.3: PYSEC-2026-1475
OSV.dev reports `Jinja2` at version `3.0.3` (declared in `requirements.txt`) is affected by PYSEC-2026-1475. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1475 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1475
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: GHSA-cpwx-vrp4-4pq7
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by GHSA-cpwx-vrp4-4pq7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa cpwx vrp4 4pq7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: GHSA-gmj6-6f8f-6699
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by GHSA-gmj6-6f8f-6699. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gmj6-6f8f-6699 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa gmj6 6f8f 6699
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: GHSA-h5c8-rqwp-cp95
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by GHSA-h5c8-rqwp-cp95. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h5c8-rqwp-cp95 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa h5c8 rqwp cp95
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: GHSA-h75v-3vvj-5mfj
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by GHSA-h75v-3vvj-5mfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h75v-3vvj-5mfj Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa h75v 3vvj 5mfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: GHSA-q2x7-8rv6-6q7h
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by GHSA-q2x7-8rv6-6q7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q2x7-8rv6-6q7h Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvGhsa q2x7 8rv6 6q7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: PYSEC-2026-1471
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by PYSEC-2026-1471. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1471 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1471
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: PYSEC-2026-1472
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by PYSEC-2026-1472. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1472 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1472
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: PYSEC-2026-1473
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by PYSEC-2026-1473. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1473 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1473
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: PYSEC-2026-1474
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by PYSEC-2026-1474. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1474 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1474
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Jinja2 3.1.2: PYSEC-2026-1475
OSV.dev reports `Jinja2` at version `3.1.2` (declared in `requirements.txt`) is affected by PYSEC-2026-1475. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1475 Fix: upgrade `Jinja2` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1475
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 4.8.0: GHSA-wrxv-2j5q-m38w
OSV.dev reports `lxml` at version `4.8.0` (declared in `requirements.txt`) is affected by GHSA-wrxv-2j5q-m38w. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wrxv-2j5q-m38w Fix: upgrade `lxml` past the affected range per the advisory.
requirements.txt ScaOsvGhsa wrxv 2j5q m38w
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lxml 4.8.0: PYSEC-2022-230
OSV.dev reports `lxml` at version `4.8.0` (declared in `requirements.txt`) is affected by PYSEC-2022-230. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2022-230 Fix: upgrade `lxml` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2022 230
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-44wm-f244-xhp3
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-44wm-f244-xhp3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-44wm-f244-xhp3 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 44wm f244 xhp3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-4x4j-2g7c-83w6
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798). Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Aliases: BIT-pillow-2026-55798, CVE-2026-55798, PYSEC-2026-2257 Advisory: https:…
requirements.txt ScaOsvGhsa 4x4j 2g7c 83w6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-fj7v-r99m-22gq
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-fj7v-r99m-22gq (aka CVE-2026-59198). Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images Aliases: BIT-pillow-2026-59198, CVE-2026-59198, PYSEC-2026-3494 Advi…
requirements.txt ScaOsvGhsa fj7v r99m 22gq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-r73j-pqj5-w3x7
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-r73j-pqj5-w3x7 (aka CVE-2026-42310). Pillow has a PDF Parsing Trailer Infinite Loop (DoS) Aliases: BIT-pillow-2026-42310, CVE-2026-42310, PYSEC-2026-2874 Advisory: https://osv.dev/vulnerability/GHSA-…
requirements.txt ScaOsvGhsa r73j pqj5 w3x7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: GHSA-wjx4-4jcj-g98j
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by GHSA-wjx4-4jcj-g98j (aka CVE-2026-42308). Pillow has an integer overflow when processing fonts Aliases: BIT-pillow-2026-42308, CVE-2026-42308, GHSA-wjx4-4jcj-g98j, PYSEC-2026-165 Advisory: https://osv.dev…
requirements.txt ScaOsvGhsa wjx4 4jcj g98j
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 10.2.0: PYSEC-2026-1793
OSV.dev reports `Pillow` at version `10.2.0` (declared in `requirements.txt`) is affected by PYSEC-2026-1793. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1793 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 1793
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-4x4j-2g7c-83w6
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798). Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Aliases: BIT-pillow-2026-55798, CVE-2026-55798, PYSEC-2026-2257 Advisory: https:…
requirements.txt ScaOsvGhsa 4x4j 2g7c 83w6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-cfh3-3jmp-rvhc
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-cfh3-3jmp-rvhc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cfh3-3jmp-rvhc Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvGhsa cfh3 3jmp rvhc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-fj7v-r99m-22gq
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-fj7v-r99m-22gq (aka CVE-2026-59198). Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images Aliases: BIT-pillow-2026-59198, CVE-2026-59198, PYSEC-2026-3494 Advi…
requirements.txt ScaOsvGhsa fj7v r99m 22gq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-pwv6-vv43-88gr
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-pwv6-vv43-88gr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvGhsa pwv6 vv43 88gr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-r73j-pqj5-w3x7
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-r73j-pqj5-w3x7 (aka CVE-2026-42310). Pillow has a PDF Parsing Trailer Infinite Loop (DoS) Aliases: BIT-pillow-2026-42310, CVE-2026-42310, PYSEC-2026-2874 Advisory: https://osv.dev/vulnerability/GHSA-…
requirements.txt ScaOsvGhsa r73j pqj5 w3x7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-whj4-6x5x-4v2j
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-whj4-6x5x-4v2j. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvGhsa whj4 6x5x 4v2j
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: GHSA-wjx4-4jcj-g98j
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by GHSA-wjx4-4jcj-g98j (aka CVE-2026-42308). Pillow has an integer overflow when processing fonts Aliases: BIT-pillow-2026-42308, CVE-2026-42308, GHSA-wjx4-4jcj-g98j, PYSEC-2026-165 Advisory: https://osv.dev…
requirements.txt ScaOsvGhsa wjx4 4jcj g98j
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: PYSEC-2026-2249
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by PYSEC-2026-2249. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2249 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2249
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: PYSEC-2026-2250
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by PYSEC-2026-2250. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2250 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2250
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 11.1.0: PYSEC-2026-2252
OSV.dev reports `Pillow` at version `11.1.0` (declared in `requirements.txt`) is affected by PYSEC-2026-2252. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2252 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvPysec 2026 2252
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-4x4j-2g7c-83w6
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798). Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Aliases: BIT-pillow-2026-55798, CVE-2026-55798, PYSEC-2026-2257 Advisory: https:…
requirements.txt ScaOsvGhsa 4x4j 2g7c 83w6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-5xmw-vc9v-4wf2
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-5xmw-vc9v-4wf2. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2 Fix: upgrade `Pillow` past the affected range per the advisory.
requirements.txt ScaOsvGhsa 5xmw vc9v 4wf2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency Pillow 12.1.1: GHSA-fj7v-r99m-22gq
OSV.dev reports `Pillow` at version `12.1.1` (declared in `requirements.txt`) is affected by GHSA-fj7v-r99m-22gq (aka CVE-2026-59198). Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images Aliases: BIT-pillow-2026-59198, CVE-2026-59198, PYSEC-2026-3494 Advi…
requirements.txt ScaOsvGhsa fj7v r99m 22gq

Showing first 300 of 523. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/987e5cbc-f5d6-46a5-be32-9065791cec6b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.