eloycoto/cilium

API keys, passwords or tokens committed into the repo.

• Serious kubernetes-secret-yaml Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments
  examples/kubernetes-ingress/deployments/guestbook/ingress/default-server-secret.yaml:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  examples/kubernetes-ingress/deployments/guestbook/ingress/default-server-secret.yaml:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/k8s/cluster/certs/ca-key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/k8s/cluster/certs/kubernetes-key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/provision/k8s_install.sh:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/k8s/cluster/cluster-manager.bash:67
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Serious CVE-2018-20060 python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2018-20060). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-20270). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-27291 python-pygments: ReDoS in multiple lexers
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-27291). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-40896 pygments: ReDoS in pygments
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2022-40896). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-11324 python-urllib3: Certification mishandle when error should be thrown
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2019-11324). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-43804 python-urllib3: Cookie request header isn't stripped during cross-origin redirects
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
  Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Serious PYSEC-2018-32 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credential
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2018-20060). Fix: Update that package to its patched version.
• Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-421 Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-140 An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-20270). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-141 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity an
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2021-27291). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-117 A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2022-40896). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pur
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to dis
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-132 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
  /workdirs/scan-463de63a-1834-42b8-847b-740bad01f272/Documentation/requirements.txt
  A package you depend on has a known security hole (CVE-2019-11236). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0