Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-48746 vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API accessCVE-2026-34993 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()CVE-2026-47265 python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirectsCVE-2026-54273 aiohttp: AIOHTTP: Denial of Service via excessive pipelined requestsCVE-2026-54274 aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloadsCVE-2026-54276 aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirectCVE-2026-54277 aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size checkCVE-2026-54278 aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request bodyGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsCVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2026-52869 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalCVE-2026-52870 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksCVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validationCVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA imageCVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font dataCVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font filesCVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font fileCVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image fileCVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds writeCVE-2026-59199 Pillow: Pillow: Denial of Service via out-of-bounds write in image processingCVE-2026-59200 Pillow: Pillow: Denial of service via crafted PDF streamCVE-2026-59204 Pillow: Pillow: Denial of Service via crafted JPEG2000 imageCVE-2026-59205 Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply APICVE-2026-55798 python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file pathsCVE-2026-59198 Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds readYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-226 vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authenticatPYSEC-2026-2104 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applicPYSEC-2026-2105 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin rePYSEC-2026-2106 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inPYSEC-2026-2107 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able PYSEC-2026-2108 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual PYSEC-2026-2109 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This PYSEC-2026-2110 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using PYSEC-2026-2111 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunkPYSEC-2026-2112 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() loPYSEC-2026-2113 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payPYSEC-2026-237 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an applicatGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsPYSEC-2026-2447 DiskCache has unsafe pickle deserializationPYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorPYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksPYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalPYSEC-2026-3483 MCP Python SDK: WebSocket server transport does not support Host/Origin validationPYSEC-2026-2253 Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without callingPYSEC-2026-2254 Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decPYSEC-2026-2255 Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() witPYSEC-2026-2256 Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompressPYSEC-2026-2257 Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the PYSEC-2026-3451 Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in IPYSEC-2026-3452 Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file tCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.