Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-26209 cbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloadsCVE-2025-68131 cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuseGHSA-6v7p-g79w-8964 MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught errorCVE-2025-67221 orjson: orjson: Denial of Service due to unbounded recursion with deeply nested JSON documentsCVE-2026-32874 UltraJSON: UltraJSON: Denial of Service due to memory leak when parsing large integersCVE-2026-32875 ultrajson: UltraJSON: Denial of Service via large indent parameter in JSON serializationCVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of ServiceCVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()Your dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use fromPYSEC-2026-2121 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics optiPYSEC-2025-238 Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-BoundPYSEC-2025-90 cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reuPYSEC-2026-2123 cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncoPYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorPYSEC-2026-3625 MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. PYSEC-2026-107 The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.PYSEC-2026-1845 pytest has vulnerable tmpdir handlingPYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system tePYSEC-2026-3071 Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector ListsPYSEC-2026-3072 Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector ParserPYSEC-2026-161 BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checksPYSEC-2026-1941 Starlette has possible denial-of-service vector when parsing large files in multipart formsPYSEC-2026-1942 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``PYSEC-2026-2280 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attrPYSEC-2026-2281 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to iPYSEC-2026-248 Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating PYSEC-2026-249 Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are ePYSEC-2026-2291 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the raPYSEC-2026-2292 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handlPYSEC-2026-2293 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exceptioPYSEC-2026-2294 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.