gitsafehub
github.com/emacarron/hdiv ↗

emacarron/hdiv

scanned 2026-08-12 · git b4d1db4
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies26Known OSS vulnerabilities117Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 26 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2016-1000031 FileUpload: DiskFileItem file manipulation
    hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000031). Fix: Update that package to its patched version.
  • Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Serious CVE-2016-1000031 FileUpload: DiskFileItem file manipulation
    pom.xml
    A package you depend on has a known security hole (CVE-2016-1000031). Fix: Update that package to its patched version.
  • Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
    pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
    hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2016-3092). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-24998 FileUpload: FileUpload DoS with excessive parts
    hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2023-24998). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48976 apache-commons-fileupload: Apache Commons FileUpload DoS via part headers
    hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2025-48976). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22243 springframework: URL Parsing with Host Validation
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2024-22243). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22259 springframework: URL Parsing with Host Validation
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2024-22259). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22262 springframework: URL Parsing with Host Validation
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2024-22262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2013-6429 Framework: XML External Entity (XXE) injection flaw
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2013-6429). Fix: Update that package to its patched version.
  • Worth fixing CVE-2013-6430 Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2013-6430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-3192 Framework: denial-of-service attack with XML input
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2015-3192). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38809 org.springframework:spring-web: Spring Framework DoS via conditional HTTP request
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2024-38809). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38820 The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
    hdiv-jsf/pom.xml
    A package you depend on has a known security hole (CVE-2024-38820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
    pom.xml
    A package you depend on has a known security hole (CVE-2016-3092). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-24998 FileUpload: FileUpload DoS with excessive parts
    pom.xml
    A package you depend on has a known security hole (CVE-2023-24998). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48976 apache-commons-fileupload: Apache Commons FileUpload DoS via part headers
    pom.xml
    A package you depend on has a known security hole (CVE-2025-48976). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22243 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22243). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22259 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22259). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22262 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2013-6429 Framework: XML External Entity (XXE) injection flaw
    pom.xml
    A package you depend on has a known security hole (CVE-2013-6429). Fix: Update that package to its patched version.
  • Worth fixing CVE-2013-6430 Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters
    pom.xml
    A package you depend on has a known security hole (CVE-2013-6430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-3192 Framework: denial-of-service attack with XML input
    pom.xml
    A package you depend on has a known security hole (CVE-2015-3192). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38809 org.springframework:spring-web: Spring Framework DoS via conditional HTTP request
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38809). Fix: Update that package to its patched version.
… 1 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 117 found · 11 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-c4q5-6c82-3qpw Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2024-38821). Fix: Update that package to its patched version.
  • Serious GHSA-hh32-7344-cg2f Authorization bypass in Spring Security
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2022-22978). Fix: Update that package to its patched version.
  • Serious GHSA-mf92-479x-3373 Spring Security HTTP Headers Are not Written Under Some Conditions
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-22732). Fix: Update that package to its patched version.
  • Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious GHSA-7x9j-7223-rg5m Improper Access Control in commons-fileupload
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000031). Fix: Update that package to its patched version.
  • Serious GHSA-hh32-7344-cg2f Authorization bypass in Spring Security
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2022-22978). Fix: Update that package to its patched version.
  • Serious GHSA-wmv4-5w76-vp9g Authorization Bypass in Spring Security
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2014-3527). Fix: Update that package to its patched version.
  • Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-core/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-spring-mvc/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-thymeleaf/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Worth fixing GHSA-269g-pwp5-87pp TemporaryFolder on unix-like systems does not limit access to created files
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2020-15250). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7v6m-28jr-rg84 Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2025-35036). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rmrm-75hp-phr2 Improper Input Validation in Hibernate Validator
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2020-10693). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x83m-pf6f-pf9g hibernate-validator Cross-site Scripting vulnerability
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2023-1932). Fix: Update that package to its patched version.
  • Worth fixing GHSA-293q-567p-wmwq Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-47838). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gq28-h5vg-8prx Privilege escalation in spring security
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2021-22112). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-41845). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-22745). Fix: Update that package to its patched version.
  • Worth fixing GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-41843). Fix: Update that package to its patched version.
  • Worth fixing GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-41846). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-41853). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f93f-g33r-8pcp Improper Restriction of XML External Entity Reference in Spring Framework
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2014-0225). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2024-38819). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux
    /workdirs/scan-2959f0c5-acc3-4523-bbfb-d3faeb116907/hdiv-config/pom.xml
    A package you depend on has a known security hole (CVE-2026-41844). Fix: Update that package to its patched version.
… 92 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.