OpsinTech/opsintech-platform

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2026-22815 aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-22815). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-34515 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34515). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-34516 aiohttp: AIOHTTP: Denial of Service via excessive multipart headers
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34516). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-34525 aiohttp: aiohttp: Security bypass via multiple Host headers
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34525). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-34993 aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34993). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-47265 python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-47265). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54273 aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54273). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54274 aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54274). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54276 aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54276). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54277 aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54277). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54278 aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54278). Fix: Update that package to its patched version.
• Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
  backend/uv.lock
  A package you depend on has a known security hole (GHSA-537c-gmf6-5ccf). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-39892). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55443 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-55443). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55443 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-55443). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44843 langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-44843). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-28277 LangGraph checkpoint loading has unsafe msgpack deserialization
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-28277). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48775 langgraph: langgraph-checkpoint: LangGraph: Arbitrary code execution via insecure deserialization of modified checkpoint bytes
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-48775). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48776 langgraph: langgraph-sdk: LangGraph Python SDK: Unsafe URL path construction leads to unauthorized resource access
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-48776). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45134 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-45134). Fix: Update that package to its patched version.
• Worth fixing GHSA-f4xh-w4cj-qxq8 LangSmith SDK TracingMiddleware: Arbitrary server-side file read
  backend/uv.lock
  A package you depend on has a known security hole (GHSA-f4xh-w4cj-qxq8). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41182 LangSmith SDK: Streaming token events bypass output redaction
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-41182). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41066 lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-41066). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41205 mako: Mako: Information disclosure via path traversal vulnerability
  backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-41205). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2026-2102 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in resp
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34520). Fix: Update that package to its patched version.
• Serious PYSEC-2026-36 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Pytho
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-39892). Fix: Update that package to its patched version.
• Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
• Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
• Serious GHSA-8vj2-vxx3-667w Arbitrary expression injection in Pillow
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
• Serious PYSEC-2026-1603 Mammoth is vulnerable to Directory Traversal
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2025-11849). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2102 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in resp
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2026-34520). Fix: Update that package to its patched version.
• Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/skills/public/ppt-master/requirements.txt
  A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2094 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This is
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-22815). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2095 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situa
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34513). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2096 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra h
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34514). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2097 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34515). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2098 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2099 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking clien
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34517). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2100 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but ret
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34518). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2101 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject ex
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34519). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2103 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34525). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2104 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applic
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-34993). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2105 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin re
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-47265). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2106 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to in
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-50269). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2107 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54273). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2108 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54274). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2109 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54276). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2110 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54277). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2111 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk
  /workdirs/scan-dfe72b27-fd0f-433e-9316-a807377b302c/backend/uv.lock
  A package you depend on has a known security hole (CVE-2026-54278). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0