bpleslie/wdc

scanned 2026-08-05 · git f7d8dbd

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies57Known OSS vulnerabilities68Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 57 found · 5 serious

Packages you depend on that have known security holes (CVEs).

Serious GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver

composer.lock

A package you depend on has a known security hole (GHSA-qm5c-m76r-2hfr). Fix: Update that package to its patched version.
Serious CVE-2016-10074 The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer ...

composer.lock

A package you depend on has a known security hole (CVE-2016-10074). Fix: Update that package to its patched version.
Serious CVE-2024-28859 Deserialization Gadget chain in Swift Mailer

composer.lock

A package you depend on has a known security hole (CVE-2024-28859). Fix: Update that package to its patched version.
Serious CVE-2019-10913 In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x ...

composer.lock

A package you depend on has a known security hole (CVE-2019-10913). Fix: Update that package to its patched version.
Serious CVE-2024-51736 CVE-2024-51736: Command execution hijack on Windows with Process class

composer.lock

A package you depend on has a known security hole (CVE-2024-51736). Fix: Update that package to its patched version.
Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

composer.lock

A package you depend on has a known security hole (GHSA-27qh-8cxx-2cr5). Fix: Update that package to its patched version.
Worth fixing CVE-2025-14761 Key Commitment Issues in S3 Encryption Clients

composer.lock

A package you depend on has a known security hole (CVE-2025-14761). Fix: Update that package to its patched version.
Worth fixing CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header

composer.lock

A package you depend on has a known security hole (CVE-2016-5385). Fix: Update that package to its patched version.
Worth fixing CVE-2022-29248 Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 ...

composer.lock

A package you depend on has a known security hole (CVE-2022-29248). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31042 Guzzle is an open source PHP HTTP client. In affected versions the `Co ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31042). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31043 Guzzle is an open source PHP HTTP client. In affected versions `Author ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31043). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31090 Guzzle, an extensible PHP HTTP client. `Authorization` headers on requ ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31090). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31091 Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` he ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31091). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Gu ...

composer.lock

A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
Worth fixing CVE-2026-55568 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain c ...

composer.lock

A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
Worth fixing CVE-2026-55767 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar in ...

composer.lock

A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
Worth fixing CVE-2026-59883 guzzle/guzzle: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar.

composer.lock

A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67339 guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Prox ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67353 guzzlehttp/guzzle versions before 7.15.1 contain a denial of service v ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67354 guzzlehttp/guzzle versions before 7.15.1 contain an information disclo ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67355 guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only co ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69245 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Se ...

composer.lock

A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.
Worth fixing CVE-2022-24775 guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8 ...

composer.lock

A package you depend on has a known security hole (CVE-2022-24775). Fix: Update that package to its patched version.
Worth fixing CVE-2023-29197 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...

composer.lock

A package you depend on has a known security hole (CVE-2023-29197). Fix: Update that package to its patched version.
Worth fixing CVE-2026-48998 guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation

composer.lock

A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.

… 32 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 68 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-9f46-5r25-5wfm Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2021-32708). Fix: Update that package to its patched version.
Serious GHSA-r7c9-c69m-rph8 Code Injection in PHPUnit

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2017-9841). Fix: Update that package to its patched version.
Serious GHSA-pr44-4jfr-286m Swift Mailer mail transport Command Injection

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2016-10074). Fix: Update that package to its patched version.
Serious GHSA-x92h-wmg2-6hp7 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2019-10913). Fix: Update that package to its patched version.
Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-557v-xcg6-rm5m Potential URI resolution path traversal in the AWS SDK for PHP

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2023-51651). Fix: Update that package to its patched version.
Worth fixing GHSA-x8cp-jf6f-r4xh AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2025-14761). Fix: Update that package to its patched version.
Worth fixing GHSA-25mq-v84q-4j7r CURLOPT_HTTPAUTH option not cleared on change of origin

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2022-31090). Fix: Update that package to its patched version.
Worth fixing GHSA-94pj-82f3-465w Guzzle: Proxy-Authorization headers can be sent to origin servers

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
Worth fixing GHSA-cwmx-hcrq-mhc3 Cross-domain cookie leakage in Guzzle

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2022-29248). Fix: Update that package to its patched version.
Worth fixing GHSA-cwxw-98qj-8qjx guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
Worth fixing GHSA-f283-ghqc-fg79 Guzzle: Unbounded response cookies risk denial of service

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
Worth fixing GHSA-f2wf-25xc-69c9 Failure to strip the Cookie header on change in host or HTTP downgrade

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2022-31042). Fix: Update that package to its patched version.
Worth fixing GHSA-f7vp-7xgx-4w4r Guzzle: Noncanonical cookie domain keeps subdomain scope

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.
Worth fixing GHSA-g446-98w2-8p5w Guzzle: Cookie Disclosure and Injection via IP-Address Domains

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
Worth fixing GHSA-h95v-h523-3mw8 Guzzle: URI fragments disclosed in redirect Referer headers

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
Worth fixing GHSA-m6ch-gg5f-wxx3 HTTP Proxy header vulnerability

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2016-5385). Fix: Update that package to its patched version.
Worth fixing GHSA-q559-8m2m-g699 Change in port should be considered a change in origin

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2022-31091). Fix: Update that package to its patched version.
Worth fixing GHSA-v5mv-p594-2x33 Guzzle: Noncanonical host can bypass host-based checks

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
Worth fixing GHSA-wm3w-8rrp-j577 Guzzle: Host-only cookie scope is not preserved

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
Worth fixing GHSA-wpwq-4j6v-78m3 guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
Worth fixing GHSA-34xg-wgjx-8xph guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
Worth fixing GHSA-c2w2-prh8-qm98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
Worth fixing GHSA-hq7v-mx3g-29hw guzzlehttp/psr7 has CRLF Injection via URI Host Component

/workdirs/scan-1c74efc8-8f80-425f-985d-7116e7ea0723/composer.lock

A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.

… 43 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.