Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Shubhamsaboo/awesome-llm-apps

https://github.com/Shubhamsaboo/awesome-llm-apps · scanned 2026-07-23 19:43 UTC (4 days, 20 hours ago)

2740 raw signals (0 security + 2740 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 20 hours ago · v9 · 2727 actionable findings from 1 signal source. 13 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
55.5
/100
Security checks
56
0 findings
System graph
56
100.0% cov · 2727 findings
Critical
23
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: critical × excluding tests × Reset all
Severity: Critical 23 High 730 Medium 1595 Low 354 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 2727 Crowd 0 Layer: Software 26 Frontend 41 Security 1771 Quality 49 Hardware 14 Cicd 4 Dependencies 821 Api 1
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 55.5/100 with 100.0% coverage. It contains 7310 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 2740 findings — concentrated in security (1771), dependencies (821), quality (54). Risk profile is high: 23 critical, 730 high, 1600 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 23 of 2727 actionable findings. 2740 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2023-50447: Pillow 10.0.0 — starter_ai_agents/ai_medical_imaging_agent/requirements.txt
pillow: Arbitrary Code Execution via the environment parameter Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Package: Pillow Installed: 10.0.0 Fixed …
VulnCve 2023 50447
critical System graph security Trivy conf 1.00 CVE-2025-14009: nltk 3.9.1 — advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong/requirements.txt
nltk: Zip Slip Vulnerability in nltk Leading to Code Execution A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This…
VulnCve 2025 14009
critical System graph security Trivy conf 1.00 CVE-2025-23042: gradio 5.9.1 — advanced_ai_agents/multi_agent_apps/ai_aqi_analysis_agent/requirements.txt
Gradio Blocked Path ACL Bypass Vulnerability Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter …
VulnCve 2025 23042
critical System graph security Trivy conf 1.00 CVE-2025-32434: torch 2.2.2 — advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong/requirements.txt
PyTorch is a Python package that provides tensor computation with stro ... PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerab…
VulnCve 2025 32434
critical System graph security Trivy conf 1.00 CVE-2025-43859: h11 0.14.0 — advanced_ai_agents/autonomous_game_playing_agent_apps/ai_tic_tac_toe_agent/requirements.txt
h11: h11 accepts some malformed Chunked-Encoding bodies h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been …
VulnCve 2025 43859
critical System graph security Trivy conf 1.00 CVE-2025-43859: h11 0.14.0 — advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong/requirements.txt
h11: h11 accepts some malformed Chunked-Encoding bodies h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been …
VulnCve 2025 43859
critical System graph security Trivy conf 1.00 CVE-2025-47241: browser-use 0.1.26 — starter_ai_agents/ai_meme_generator_agent_browseruse/requirements.txt
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component. Package: browser-use Installed: 0…
VulnCve 2025 47241
critical System graph security Trivy conf 1.00 CVE-2025-55182: next 15.3.2 — generative_ui_agents/ai-dashboard-canvas-agent/pnpm-lock.yaml
next: React Server Components: Pre-authentication remote code execution via unsafe deserialization A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react…
VulnCve 2025 55182
critical System graph security Trivy conf 1.00 CVE-2025-55182: next 15.3.3 — advanced_ai_agents/multi_agent_apps/agent_teams/ai_travel_planner_agent_team/client/pnpm-lock.yaml
next: React Server Components: Pre-authentication remote code execution via unsafe deserialization A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react…
VulnCve 2025 55182
critical System graph security Trivy conf 1.00 CVE-2025-68664: langchain-core 0.3.25 — rag_tutorials/rag_agent_cohere/requirements.txt
langchain-core: LangChain: Arbitrary code execution via serialization injection LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions …
VulnCve 2025 68664
critical System graph security Trivy conf 1.00 CVE-2025-68664: langchain-core 0.3.28 — rag_tutorials/corrective_rag/requirements.txt
langchain-core: LangChain: Arbitrary code execution via serialization injection LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions …
VulnCve 2025 68664
critical System graph security Trivy conf 1.00 CVE-2025-68664: langchain-core 0.3.28 — rag_tutorials/rag_database_routing/requirements.txt
langchain-core: LangChain: Arbitrary code execution via serialization injection LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions …
VulnCve 2025 68664
critical System graph security Trivy conf 1.00 CVE-2025-68664: langchain-core 0.3.49 — advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong/requirements.txt
langchain-core: LangChain: Arbitrary code execution via serialization injection LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions …
VulnCve 2025 68664
critical System graph security Trivy conf 1.00 CVE-2025-68664: langchain-core 0.3.65 — advanced_ai_agents/single_agent_apps/windows_use_autonomous_agent/uv.lock
langchain-core: LangChain: Arbitrary code execution via serialization injection LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions …
VulnCve 2025 68664
critical System graph security Trivy conf 1.00 CVE-2026-25896: fast-xml-parser 5.2.5 — generative_ui_agents/ai-dashboard-canvas-agent/pnpm-lock.yaml
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE en…
VulnCve 2026 25896
critical System graph security Trivy conf 1.00 CVE-2026-35002: agno 1.4.2 — advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong/requirements.txt
Agno is vulnerable to Eval Injection Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_…
VulnCve 2026 35002
critical System graph security Trivy conf 1.00 CVE-2026-35002: agno 1.5.6 — advanced_ai_agents/multi_agent_apps/agent_teams/ai_travel_planner_agent_team/backend/uv.lock
Agno is vulnerable to Eval Injection Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_…
VulnCve 2026 35002
critical System graph security Trivy conf 1.00 CVE-2026-41242: protobufjs 7.5.4 — generative_ui_agents/ai-mcp-app-builder/pnpm-lock.yaml
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will …
VulnCve 2026 41242
critical System graph security Trivy conf 1.00 CVE-2026-4810: google-adk 1.26.0 — generative_ui_agents/ai-financial-coach-agent/agent/uv.lock
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an u…
VulnCve 2026 4810
critical System graph security Trivy conf 1.00 CVE-2026-4810: google-adk 1.9.0 — always_on_agents/release_radar_agent/requirements.txt
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an u…
VulnCve 2026 4810
critical System graph security Trivy conf 1.00 CVE-2026-53512: better-auth 1.2.8 — advanced_ai_agents/multi_agent_apps/agent_teams/ai_travel_planner_agent_team/client/pnpm-lock.yaml
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant auth…
VulnCve 2026 53512
critical System graph security Trivy conf 1.00 CVE-2026-59873: tar 7.5.13 — generative_ui_agents/ai-mcp-app-builder/pnpm-lock.yaml
tar: node-tar: Denial of Service via crafted gzip bomb node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, a…
VulnCve 2026 59873
critical System graph security Trivy conf 1.00 GHSA-xg6x-h9c9-2m83: better-auth 1.2.8 — advanced_ai_agents/multi_agent_apps/agent_teams/ai_travel_planner_agent_team/client/pnpm-lock.yaml
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) ### Summary Under certain configurations, sessions may be considered valid before two-factor authentication (2FA) is fully completed. This can allow access to authenticated routes without verifyin…
VulnGhsa xg6x h9c9 2m83
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/b8f7260d-811b-4566-a173-54eaa034c741/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/b8f7260d-811b-4566-a173-54eaa034c741/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.