adyoull/umap

scanned 2026-08-13 · git 2174154

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies104Known OSS vulnerabilities500Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 104 found · 13 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2021-44906 minimist: prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()

requirements.txt

A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
Serious CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL

requirements.txt

A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
Serious CVE-2025-64459 django: Django SQL injection

requirements.txt

A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
Serious CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2

requirements.txt

A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
Serious CVE-2021-25289 python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c

requirements.txt

A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
Serious CVE-2021-34552 python-pillow: Buffer overflow in image convert function

requirements.txt

A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

requirements.txt

A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter

requirements.txt

A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
Worth fixing CVE-2016-10540 Minimatch is a minimal matching utility that works by converting glob ...

package-lock.json

A package you depend on has a known security hole (CVE-2016-10540). Fix: Update that package to its patched version.
Worth fixing CVE-2022-3517 nodejs-minimatch: ReDoS via the braceExpand function

package-lock.json

A package you depend on has a known security hole (CVE-2022-3517). Fix: Update that package to its patched version.
Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns

package-lock.json

A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns

package-lock.json

A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions

package-lock.json

A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
Worth fixing NSWG-ECO-118 Regular Expression Denial of Service

package-lock.json

A package you depend on has a known security hole (NSWG-ECO-118). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

package-lock.json

A package you depend on has a known security hole (CVE-2020-7598). Fix: Update that package to its patched version.
Worth fixing CVE-2026-5758 protocol-buffers-schema: protocol-buffers-schema: Remote code execution via prototype pollution

package-lock.json

A package you depend on has a known security hole (CVE-2026-5758). Fix: Update that package to its patched version.

… 79 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 500 found · 61 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Serious GHSA-957j-59c2-j692 Prototype pollution in getobject

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2020-28282). Fix: Update that package to its patched version.
Serious GHSA-qh2h-chj9-jffq Growl before 1.10.0 vulnerable to Command Injection

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2017-16042). Fix: Update that package to its patched version.
Serious GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-3918). Fix: Update that package to its patched version.
Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious GHSA-34r7-q49f-h37c Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2015-8857). Fix: Update that package to its patched version.
Serious GHSA-34r7-q49f-h37c Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2015-8857). Fix: Update that package to its patched version.
Serious GHSA-cf4h-3jhx-xvhq Arbitrary Code Execution in underscore

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2021-23358). Fix: Update that package to its patched version.
Serious GHSA-crh6-fp67-6883 xmldom allows multiple root nodes in a DOM

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/package-lock.json

A package you depend on has a known security hole (CVE-2022-39353). Fix: Update that package to its patched version.
Serious PYSEC-2022-190 An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
Serious PYSEC-2022-191 A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion)

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT

/workdirs/scan-644ce1f5-9995-4404-8216-41bf177f0c5b/requirements-docker.txt

A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.

… 475 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.