brendt/yii2-house2house

scanned 2026-08-13 · git 8534b1b

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies65Known OSS vulnerabilities73Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 65 found · 7 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2021-46743 Key/algorithm type confusion

composer.lock

A package you depend on has a known security hole (CVE-2021-46743). Fix: Update that package to its patched version.
Serious CVE-2026-34084 PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

composer.lock

A package you depend on has a known security hole (CVE-2026-34084). Fix: Update that package to its patched version.
Serious CVE-2026-45034 PHPSpreadsheet has a patch bypass for CVE-2026-34084

composer.lock

A package you depend on has a known security hole (CVE-2026-45034). Fix: Update that package to its patched version.
Serious CVE-2024-28859 Deserialization Gadget chain in Swift Mailer

composer.lock

A package you depend on has a known security hole (CVE-2024-28859). Fix: Update that package to its patched version.
Serious CVE-2020-15148 Possible remote code execution via unserialize() on user input containing specially crafted string

composer.lock

A package you depend on has a known security hole (CVE-2020-15148). Fix: Update that package to its patched version.
Serious CVE-2024-4990 Unsafe Reflection in base Component class

composer.lock

A package you depend on has a known security hole (CVE-2024-4990). Fix: Update that package to its patched version.
Serious CVE-2024-58136 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

composer.lock

A package you depend on has a known security hole (CVE-2024-58136). Fix: Update that package to its patched version.
Worth fixing CVE-2021-41165 CKEditor4 is an open source WYSIWYG HTML editor. In affected version a ...

composer.lock

A package you depend on has a known security hole (CVE-2021-41165). Fix: Update that package to its patched version.
Worth fixing CVE-2024-24815 CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. ...

composer.lock

A package you depend on has a known security hole (CVE-2024-24815). Fix: Update that package to its patched version.
Worth fixing CVE-2024-43407 CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. ...

composer.lock

A package you depend on has a known security hole (CVE-2024-43407). Fix: Update that package to its patched version.
Worth fixing CVE-2026-6409 A Denial of Service (DoS) vulnerability exists in the Protobuf PHP lib ...

composer.lock

A package you depend on has a known security hole (CVE-2026-6409). Fix: Update that package to its patched version.
Worth fixing CVE-2022-29248 Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 ...

composer.lock

A package you depend on has a known security hole (CVE-2022-29248). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31042 Guzzle is an open source PHP HTTP client. In affected versions the `Co ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31042). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31043 Guzzle is an open source PHP HTTP client. In affected versions `Author ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31043). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31090 Guzzle, an extensible PHP HTTP client. `Authorization` headers on requ ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31090). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31091 Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` he ...

composer.lock

A package you depend on has a known security hole (CVE-2022-31091). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Gu ...

composer.lock

A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
Worth fixing CVE-2026-55568 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain c ...

composer.lock

A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
Worth fixing CVE-2026-55767 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar in ...

composer.lock

A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
Worth fixing CVE-2026-59883 guzzle/guzzle: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar.

composer.lock

A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67339 guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Prox ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67353 guzzlehttp/guzzle versions before 7.15.1 contain a denial of service v ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67354 guzzlehttp/guzzle versions before 7.15.1 contain an information disclo ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
Worth fixing CVE-2026-67355 guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only co ...

composer.lock

A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69245 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Se ...

composer.lock

A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.

… 40 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 73 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-4574-qv3w-fcmg Deserialization of Untrusted Data in codeception/codeception

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2021-23420). Fix: Update that package to its patched version.
Serious GHSA-8xf4-w7qw-pjjw Firebase PHP-JWT key/algorithm type confusion

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2021-46743). Fix: Update that package to its patched version.
Serious GHSA-87m4-826x-3crx PHPSpreadsheet has a patch bypass for CVE-2026-34084

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-45034). Fix: Update that package to its patched version.
Serious GHSA-q4q6-r8wh-5cgh PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-34084). Fix: Update that package to its patched version.
Serious GHSA-ggwg-cmwp-46r5 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2024-58136). Fix: Update that package to its patched version.
Worth fixing GHSA-7h26-63m7-qhf2 HTML comments vulnerability allowing to execute JavaScript code

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2021-41165). Fix: Update that package to its patched version.
Worth fixing GHSA-7r32-vfj5-c2jv Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2024-43407). Fix: Update that package to its patched version.
Worth fixing GHSA-fq6h-4g8v-qqvm CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2024-24815). Fix: Update that package to its patched version.
Worth fixing GHSA-2x45-7fc3-mxwq php-jwt contains weak encryption

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2025-45769). Fix: Update that package to its patched version.
Worth fixing GHSA-p2gh-cfq4-4wjc Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-6409). Fix: Update that package to its patched version.
Worth fixing GHSA-25mq-v84q-4j7r CURLOPT_HTTPAUTH option not cleared on change of origin

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2022-31090). Fix: Update that package to its patched version.
Worth fixing GHSA-94pj-82f3-465w Guzzle: Proxy-Authorization headers can be sent to origin servers

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
Worth fixing GHSA-cwmx-hcrq-mhc3 Cross-domain cookie leakage in Guzzle

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2022-29248). Fix: Update that package to its patched version.
Worth fixing GHSA-cwxw-98qj-8qjx guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
Worth fixing GHSA-f283-ghqc-fg79 Guzzle: Unbounded response cookies risk denial of service

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
Worth fixing GHSA-f2wf-25xc-69c9 Failure to strip the Cookie header on change in host or HTTP downgrade

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2022-31042). Fix: Update that package to its patched version.
Worth fixing GHSA-f7vp-7xgx-4w4r Guzzle: Noncanonical cookie domain keeps subdomain scope

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.
Worth fixing GHSA-g446-98w2-8p5w Guzzle: Cookie Disclosure and Injection via IP-Address Domains

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
Worth fixing GHSA-h95v-h523-3mw8 Guzzle: URI fragments disclosed in redirect Referer headers

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
Worth fixing GHSA-q559-8m2m-g699 Change in port should be considered a change in origin

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2022-31091). Fix: Update that package to its patched version.
Worth fixing GHSA-v5mv-p594-2x33 Guzzle: Noncanonical host can bypass host-based checks

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
Worth fixing GHSA-wm3w-8rrp-j577 Guzzle: Host-only cookie scope is not preserved

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
Worth fixing GHSA-wpwq-4j6v-78m3 guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
Worth fixing GHSA-34xg-wgjx-8xph guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
Worth fixing GHSA-c2w2-prh8-qm98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

/workdirs/scan-c0cddcc3-02e9-46fe-9755-776ce971d226/composer.lock

A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.

… 48 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.