Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.Packages you depend on that have known security holes (CVEs).
CVE-2024-41110 moby: Authz zero length regressionCVE-2024-23652 moby/buildkit: possible host system access from mount stub cleanerCVE-2024-23653 moby/buildkit: Buildkit's interactive containers API does not validate entitlements checkCVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validationCVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalationCVE-2026-53488 github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI pluginCVE-2024-40635 containerd: containerd has an integer overflow in User ID handlingCVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaksCVE-2026-47262 github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsingGHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a containerCVE-2025-0495 Buildx is a Docker CLI plugin that extends build capabilities using Bu ...CVE-2025-15558 docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binariesCVE-2026-34040 Moby: Moby: Authorization bypass vulnerabilityCVE-2024-24557 moby: classic builder cache poisoningCVE-2026-33997 moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installationGHSA-jq35-85cj-fj4p /sys/devices/virtual/powercap accessible by default to containersGHSA-pmwq-pjrm-6p5r in-toto-golang and in-toto-python have inconsistent negation behaviorCVE-2024-23651 moby/buildkit: possible race condition with accessing subpaths from cache mountsCVE-2026-33747 BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontendCVE-2026-33748 github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir componentsCVE-2024-23650 moby/buildkit: Possible race condition with accessing subpaths from cache mountsCVE-2026-35469 Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming codeCVE-2024-21626 runc: file descriptor leakCVE-2025-31133 runc: container escape via 'masked path' abuse due to mount race conditionsCVE-2025-52565 runc: container escape with malicious config due to /dev/console mount and related racesYour dependencies cross-checked against the OSV vulnerability database.
GO-2024-3005 Moby authz zero length regression in github.com/moby/mobyGO-2024-2494 Host system modification in github.com/moby/buildkitGO-2024-2497 Privilege escalation in github.com/moby/buildkitGO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptoGO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpcGO-2025-3528 containerd has an integer overflow in User ID handling in github.com/containerd/containerdGO-2025-4100 containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerdGO-2025-4108 containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerdGO-2026-5475 containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerdGO-2026-5758 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerdGO-2025-3527 buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildxGO-2026-4610 Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cliGO-2024-2512 Classic builder cache poisoning in github.com/docker/dockerGO-2026-4883 Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/dockerGO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/dockerGO-2026-5617 Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirectionGO-2026-5668 Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary filesGO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/dockerCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.