gitsafehub
github.com/chayanforyou/machine-learning-python ↗

chayanforyou/machine-learning-python

scanned 2026-08-11 · git 9392938
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies383Known OSS vulnerabilities415Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 383 found · 3 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-41208 Incomplete validation in boosted trees code
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-41208). Fix: Update that package to its patched version.
  • Serious CVE-2023-25668 CVE-2023-25668 affecting package tensorflow for versions less than 2.11.1-1
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2023-25668). Fix: Update that package to its patched version.
  • Serious GHSA-h6gw-r52c-724r NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (GHSA-h6gw-r52c-724r). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-15265 Segfault in `tf.quantization.quantize_and_dequantize`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-15265). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-29591 Stack overflow due to looping TFLite subgraph
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-29591). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37635 Heap out of bounds access in sparse reduction operations
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37635). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37637 Null pointer dereference in `CompressElement`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37637). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37638 Null pointer dereference in `RaggedTensorToTensor`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37638). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37639 Null pointer dereference and heap OOB read in operations restoring tensors
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37639). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37643 Null pointer dereference in `MatrixDiagPartOp`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37643). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37647 Null pointer dereference in `SparseTensorSliceDataset`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37647). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37648 Incorrect validation of `SaveV2` inputs
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37648). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37649 Null pointer dereference in `UncompressElement`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37649). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37650 Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37650). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37651 Heap buffer overflow in `FractionalAvgPoolGrad`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37652 Use after free in boosted trees creation
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37652). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37654 Heap OOB and CHECK fail in `ResourceGather`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37654). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37655 Heap OOB in `ResourceScatterUpdate`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37655). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37659 Reference binding to nullptr and heap OOB in binary cwise ops
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37659). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37663 Incomplete validation in `QuantizeV2`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37663). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37664 Heap OOB in boosted trees
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37664). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37665 Incomplete validation in MKL requantization
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37665). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37666 Reference binding to nullptr in `RaggedTensorToVariant`
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37666). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37667 Reference binding to nullptr in unicode encoding
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37667). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37671 Reference binding to nullptr in map operations
    TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37671). Fix: Update that package to its patched version.
… 358 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 415 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2026-1486 Keras Directory Traversal Vulnerability
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2025-12060). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-400 TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of serv
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-41208). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-548 TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2023-25668). Fix: Update that package to its patched version.
  • Serious GHSA-h6gw-r52c-724r NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-r6jx-9g48-2r5r Arbitrary code execution due to YAML deserialization
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2021-37678). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2025-123 The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Mode
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2025-9905). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1487 Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2025-12058). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2324 Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-11816). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2546 Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-1669). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2547 Keras has an untrusted deserialization vulnerability
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-1462). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3629 Keras: HDF5 virtual datasets can disclose local files
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-12480). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3631 Keras: Lambda deserialization can bypass safe mode and execute code
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-12481). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3632 Keras: DiskIOStore permits path traversal through crafted layer names
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-12479). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3633 Keras: HDF5 links can disclose local file contents
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-9335). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3634 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-12484). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-73 Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (D
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2026-0897). Fix: Update that package to its patched version.
  • Worth fixing GHSA-36fq-jgmw-4r9c Keras is vulnerable to Deserialization of Untrusted Data
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2025-9906). Fix: Update that package to its patched version.
  • Worth fixing GHSA-c9rc-mg46-23w3 Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2025-8747). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-138 In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results in accessing a dimension outside the rank of the input tenso
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-15265). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-139 In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attem
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-15266). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-140 In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26267). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-254 In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default v
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26266). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-255 In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26268). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-256 In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a qu
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26270). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-257 In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge b
    /workdirs/scan-5791ec05-21f7-4b19-a53f-c1b1cf781209/TrafficSignClassification/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26271). Fix: Update that package to its patched version.
… 390 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.