Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Zackriya-Solutions/meetily

https://github.com/Zackriya-Solutions/meetily · scanned 2026-07-23 19:44 UTC (4 days, 14 hours ago)

218 raw signals (0 security + 218 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 14 hours ago · v7 · last Δ +0.2 (diff) · 207 actionable findings from 1 signal source. 11 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

90.0% cov · 207 findings

Severity distribution — click a segment to filter

Active filters: layer: dependencies × excluding tests × Reset all

Severity: Critical 0 High 43 Medium 84 Low 70 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 207 Crowd 0 Layer: Software 2 Frontend 59 Security 71 Cicd 3 Quality 11 Dependencies 61

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 56.6/100 with 90.0% coverage. It contains 1420 nodes across 19 cross-layer flows, written primarily in mixed languages. Engine surfaced 218 findings — concentrated in security (71), dependencies (61), frontend (59). Risk profile is high: 0 critical, 43 high, 94 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 61 of 207 actionable findings. 218 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr…

frontend/package.json ScaOsvGhsa 36qx fr4f 26g5

high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x…

frontend/package.json ScaOsvGhsa 89xv 2m56 2m9x

high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the ad…

frontend/package.json ScaOsvGhsa 8h8q 6873 q5fj

high System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q

OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Aliases: CVE-2026-45623 Advisory: https:/…

frontend/package.json ScaOsvGhsa 6g55 p6wh 862q

high System graph dependencies dependencies conf 1.00 Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3

OSV.dev reports `pydantic-ai` at version `0.2.15` (declared in `backend/requirements.txt`) is affected by GHSA-2jrp-274c-jhv3 (aka CVE-2026-25580). Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling Aliases: CVE-2026-25580, PYSEC-2026-2976, PYSEC-2026-2980 Advisory: https…

backend/requirements.txt ScaOsvGhsa 2jrp 274c jhv3

high System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539). python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service Aliases: CVE-2026-53539, PYSEC-2026-…

backend/requirements.txt ScaOsvGhsa 5rvq cxj2 64vf

high System graph dependencies dependencies conf 0.70 Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9

OSV.dev reports `tauri` at version `2.6.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184). Note: `2.6.2` is the declared floor of a range — the installed version may be newer. Tauri has an Origin Confusion Issue that Allows Remote Pages to Inv…

frontend/src-tauri/Cargo.toml ScaOsvGhsa 7gmj 67g7 phm9

high System graph dependencies dependencies conf 0.70 Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8

OSV.dev reports `zip` at version `2.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-94vh-gphv-8pm8 (aka CVE-2025-29787). Note: `2.2` is the declared floor of a range — the installed version may be newer. zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to …

frontend/src-tauri/Cargo.toml ScaOsvGhsa 94vh gphv 8pm8

medium System graph dependencies dependencies conf 0.90 Dependency rubato is two or more major versions behind

`rubato` is pinned at `0.15.0` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `4.0.0` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `rubato` to `4…

frontend/src-tauri/Cargo.toml FreshnessOutdated

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190

OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190. Unsoundness in `Error::downcast_mut()` Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190 Fix: upgrade `anyhow` past the affected range per the advisory.

Cargo.toml ScaOsvRustsec 2026 0190

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413

OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413. Note: `atk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413 Fi…

Cargo.lock ScaOsvRustsec 2024 0413

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416

OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416. Note: `atk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…

Cargo.lock ScaOsvRustsec 2024 0416

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: GHSA-g98v-hv3f-hcfr

OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by GHSA-g98v-hv3f-hcfr. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g98v-hv3f-h…

Cargo.lock ScaOsvGhsa g98v hv3f hcfr

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: RUSTSEC-2021-0145

OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2021-0145. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2021-0145 …

Cargo.lock ScaOsvRustsec 2021 0145

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atty 0.2.14: RUSTSEC-2024-0375

OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0375. Note: `atty` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0375 …

Cargo.lock ScaOsvRustsec 2024 0375

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency bytes 1.9.0: GHSA-434x-w66g-qw3r

OSV.dev reports `bytes` at version `1.9.0` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-434x-w66g-qw3r (aka CVE-2026-25541). Note: `1.9.0` is the declared floor of a range — the installed version may be newer. bytes has integer overflow in BytesMut::reserve Aliases: CVE-2026-…

frontend/src-tauri/Cargo.toml ScaOsvGhsa 434x w66g qw3r

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204

OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204. Note: `crossbeam-epoch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…

Cargo.lock ScaOsvRustsec 2026 0204

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdk 0.18.2: RUSTSEC-2024-0412

OSV.dev reports `gdk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0412. Note: `gdk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0412 Fi…

Cargo.lock ScaOsvRustsec 2024 0412

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdk-sys 0.18.2: RUSTSEC-2024-0418

OSV.dev reports `gdk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0418. Note: `gdk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…

Cargo.lock ScaOsvRustsec 2024 0418

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkwayland-sys 0.18.2: RUSTSEC-2024-0411

OSV.dev reports `gdkwayland-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0411. Note: `gdkwayland-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabilit…

Cargo.lock ScaOsvRustsec 2024 0411

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkx11 0.18.2: RUSTSEC-2024-0417

OSV.dev reports `gdkx11` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0417. Note: `gdkx11` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0…

Cargo.lock ScaOsvRustsec 2024 0417

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gdkx11-sys 0.18.2: RUSTSEC-2024-0414

OSV.dev reports `gdkx11-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0414. Note: `gdkx11-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSE…

Cargo.lock ScaOsvRustsec 2024 0414

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency glib 0.18.5: GHSA-wrw7-89jp-8q8g

OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by GHSA-wrw7-89jp-8q8g. Note: `glib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wrw7-89jp-8…

Cargo.lock ScaOsvGhsa wrw7 89jp 8q8g

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency glib 0.18.5: RUSTSEC-2024-0429

OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0429. Note: `glib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0429 …

Cargo.lock ScaOsvRustsec 2024 0429

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk 0.18.2: RUSTSEC-2024-0415

OSV.dev reports `gtk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0415. Note: `gtk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0415 Fi…

Cargo.lock ScaOsvRustsec 2024 0415

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk-sys 0.18.2: RUSTSEC-2024-0420

OSV.dev reports `gtk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0420. Note: `gtk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…

Cargo.lock ScaOsvRustsec 2024 0420

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency gtk3-macros 0.18.2: RUSTSEC-2024-0419

OSV.dev reports `gtk3-macros` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0419. Note: `gtk3-macros` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUST…

Cargo.lock ScaOsvRustsec 2024 0419

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-3x4c-7xq6-9pq8

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3x4c-7xq6-9pq8 (aka CVE-2026-27980). Next.js: Unbounded next/image disk cache growth can exhaust storage Aliases: CVE-2026-27980 Advisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 Fix:…

frontend/package.json ScaOsvGhsa 3x4c 7xq6 9pq8

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-4633-3j49-mh5q

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.d…

frontend/package.json ScaOsvGhsa 4633 3j49 mh5q

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-4c39-4ccg-62r3

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `n…

frontend/package.json ScaOsvGhsa 4c39 4ccg 62r3

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-68g3-v927-f742

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix…

frontend/package.json ScaOsvGhsa 68g3 v927 f742

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-955p-x3mx-jcvp

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcv…

frontend/package.json ScaOsvGhsa 955p x3mx jcvp

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-9g9p-9gw9-jx7f

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-9g9p-9gw9-jx7f (aka CVE-2025-59471). Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration Aliases: CVE-2025-59471 Advisory: https://osv.dev/vulner…

frontend/package.json ScaOsvGhsa 9g9p 9gw9 jx7f

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-c4j6-fc7j-m34r

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-c4j6-fc7j-m34r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa c4j6 fc7j m34r

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-ffhc-5mcf-pf4q

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ffhc-5mcf-pf4q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa ffhc 5mcf pf4q

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-ggv3-7p47-pfv8

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ggv3-7p47-pfv8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa ggv3 7p47 pfv8

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-gx5p-jg67-6x7h

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-gx5p-jg67-6x7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa gx5p jg67 6x7h

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-h25m-26qc-wcjf

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h25m-26qc-wcjf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa h25m 26qc wcjf

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-h64f-5h5j-jqjh

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h64f-5h5j-jqjh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa h64f 5h5j jqjh

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-m99w-x7hq-7vfj

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-m99w-x7hq-7vfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa m99w x7hq 7vfj

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-p9j2-gv94-2wf4

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-p9j2-gv94-2wf4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa p9j2 gv94 2wf4

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-q4gf-8mx6-v5v3

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-q4gf-8mx6-v5v3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa q4gf 8mx6 v5v3

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-vfv6-92ff-j949

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa vfv6 92ff j949

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-wfc6-r584-vfw7

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa wfc6 r584 vfw7

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93

OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.

frontend/package.json ScaOsvGhsa qx2v qp2m jg93

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-dotenv 1.1.0: GHSA-mf9w-mj56-hr94

OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by GHSA-mf9w-mj56-hr94. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94 Fix: upgrade `python-dotenv` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa mf9w mj56 hr94

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-dotenv 1.1.0: PYSEC-2026-2270

OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-2270. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2270 Fix: upgrade `python-dotenv` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 2270

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-6jv3-5f52-599m

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-6jv3-5f52-599m (aka CVE-2026-53538). python-multipart: Semicolon treated as querystring field separator enables parameter smuggling Aliases: CVE-2026-53538, PYSEC-2026-3037 Advisory…

backend/requirements.txt ScaOsvGhsa 6jv3 5f52 599m

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-mj87-hwqh-73pj

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-mj87-hwqh-73pj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mj87-hwqh-73pj Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa mj87 hwqh 73pj

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-pp6c-gr5w-3c5g

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-pp6c-gr5w-3c5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pp6c-gr5w-3c5g Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa pp6c gr5w 3c5g

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-v9pg-7xvm-68hf

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-v9pg-7xvm-68hf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa v9pg 7xvm 68hf

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-vffw-93wf-4j4q

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-vffw-93wf-4j4q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa vffw 93wf 4j4q

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: GHSA-wp53-j4wj-2cfg

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-wp53-j4wj-2cfg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvGhsa wp53 j4wj 2cfg

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-1852

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-1852. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1852 Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 1852

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3038

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3038. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3038 Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 3038

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3039

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3039. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3039 Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 3039

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3040

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3040. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3040 Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 3040

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3041

OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3041. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3041 Fix: upgrade `python-multipart` past the affected range per the advisory.

backend/requirements.txt ScaOsvPysec 2026 3041

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2

OSV.dev reports `tar` at version `0.4.45` (resolved in `Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2. tar has a PAX header desynchronization issue Advisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2 Fix: upgrade `tar` past the affected range per the advisory.

frontend/src-tauri/Cargo.toml ScaOsvGhsa 3pv8 6f4r ffg2

low System graph dependencies dependencies conf 0.90 Dependency dirs is a major version behind

`dirs` is pinned at `5.0.1` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `6.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `dirs` to `6.0.0`.

frontend/src-tauri/Cargo.toml FreshnessOutdated

low System graph dependencies dependencies conf 1.00 Vulnerable dependency next 14.2.35: GHSA-3g8h-86w9-wvmq

OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3g8h-86w9-wvmq (aka CVE-2026-44572). Next.js's Middleware / Proxy redirects can be cache-poisoned Aliases: CVE-2026-44572 Advisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq Fix: upgrad…

frontend/package.json ScaOsvGhsa 3g8h 86w9 wvmq

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/f5451e83-66f9-442b-a2ca-8313459d230e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.