nepxion/discovery

scanned 2026-07-01 · git 2a5a8e9

3 of 6 checks flagged a security issue

🔴 Needs attention

6 checks ran. Start with known oss vulnerabilities below.

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies21Known OSS vulnerabilities347Risky code patterns✓Malicious dependencies✓Project health8

Security checks

Leaked secrets — Gitleaksⓘ 1 found

API keys, passwords or tokens committed into the repo.

Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

discovery-springcloud-examples/discovery-springcloud-example-console/src/main/resources/bootstrap.properties:32

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 21 found · 6 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

discovery-console/discovery-console-starter/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

discovery-console/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

discovery-plugin-admin-center/discovery-plugin-admin-center-starter-swagger/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

discovery-plugin-admin-center/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious CVE-2019-17495 Cross-site scripting in Swagger-UI

pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Worth fixing CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

discovery-commons/discovery-common/pom.xml

A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

discovery-commons/discovery-common/pom.xml

A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
Worth fixing CVE-2025-48924 commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang

discovery-commons/discovery-common/pom.xml

A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
Worth fixing CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

discovery-commons/pom.xml

A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

discovery-commons/pom.xml

A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
Worth fixing CVE-2025-48924 commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang

discovery-commons/pom.xml

A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
Worth fixing CVE-2023-2976 guava: insecure temporary directory creation

discovery-plugin-framework/discovery-plugin-framework-starter/pom.xml

A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
Worth fixing CVE-2023-2976 guava: insecure temporary directory creation

discovery-plugin-framework/pom.xml

A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
Worth fixing CVE-2023-2976 guava: insecure temporary directory creation

pom.xml

A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
Worth fixing CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

pom.xml

A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

pom.xml

A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
Worth fixing CVE-2025-48924 commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang

pom.xml

A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
Minor CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions

discovery-plugin-framework/discovery-plugin-framework-starter/pom.xml

A package you depend on has a known security hole (CVE-2020-8908). Fix: Update that package to its patched version.
Minor CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions

discovery-plugin-framework/pom.xml

A package you depend on has a known security hole (CVE-2020-8908). Fix: Update that package to its patched version.
Minor CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions

pom.xml

A package you depend on has a known security hole (CVE-2020-8908). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 347 found · 26 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-apollo/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-apollo/pom.xml

A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-consul/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-consul/pom.xml

A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-etcd/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-etcd/pom.xml

A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
Serious GHSA-2qrg-x229-3v8q Deserialization of Untrusted Data in Log4j

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2019-17571). Fix: Update that package to its patched version.
Serious GHSA-65fg-84f6-3jq3 SQL Injection in Log4j 1.2.x

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2022-23305). Fix: Update that package to its patched version.
Serious GHSA-f7vh-qwp3-x37m Deserialization of Untrusted Data in Apache Log4j

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2022-23307). Fix: Update that package to its patched version.
Serious GHSA-7286-pgfv-vxvh Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2023-44981). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-commons/discovery-common-zookeeper/pom.xml

A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
Serious GHSA-c427-hjc3-wrfw Cross-site scripting in Swagger-UI

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.
Serious GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2024-50379). Fix: Update that package to its patched version.
Serious GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2026-43515). Fix: Update that package to its patched version.
Serious GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2025-24813). Fix: Update that package to its patched version.
Serious GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2025-66614). Fix: Update that package to its patched version.
Serious GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2026-43512). Fix: Update that package to its patched version.
Serious GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2026-41293). Fix: Update that package to its patched version.
Serious GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2025-55754). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter-apollo/pom.xml

A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
Serious GHSA-c427-hjc3-wrfw Cross-site scripting in Swagger-UI

/workdirs/scan-e7cea71a-5939-46da-95dc-c00f53edecff/discovery-console/discovery-console-starter/pom.xml

A package you depend on has a known security hole (CVE-2019-17495). Fix: Update that package to its patched version.

… 322 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 8 notes

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

Worth fixing scorecard-overall OpenSSF Scorecard overall: 2.4/10

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Code-Review Code-Review scored 0: Found 0/30 approved changesets -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Dependency-Update-Tool Dependency-Update-Tool scored 0: no update tool detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Maintained Maintained scored 0: 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-SAST SAST scored 0: no SAST tool detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Security-Policy Security-Policy scored 0: security policy file not detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.

via OpenSSF Scorecard v5.5.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.