fluxml/fluxbench.jl

scanned 2026-08-11 · git 6131b48

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies465Known OSS vulnerabilities✓Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found

API keys, passwords or tokens committed into the repo.

Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

.buildkite/pipeline.yml:36

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

.buildkite/pipeline.yml:11

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 465 found · 30 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2024-29157 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-29157). Fix: Update that package to its patched version.
Serious CVE-2024-29159 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-29159). Fix: Update that package to its patched version.
Serious CVE-2024-29164 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-29164). Fix: Update that package to its patched version.
Serious CVE-2024-32608 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-32608). Fix: Update that package to its patched version.
Serious CVE-2024-32611 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-32611). Fix: Update that package to its patched version.
Serious CVE-2024-32615 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-32615). Fix: Update that package to its patched version.
Serious CVE-2024-32621 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-32621). Fix: Update that package to its patched version.
Serious CVE-2024-32622 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-32622). Fix: Update that package to its patched version.
Serious CVE-2024-33874 hdf5: multiple CVEs

Manifest.toml

A package you depend on has a known security hole (CVE-2024-33874). Fix: Update that package to its patched version.
Serious CVE-2018-16328 ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c

Manifest.toml

A package you depend on has a known security hole (CVE-2018-16328). Fix: Update that package to its patched version.
Serious CVE-2018-16329 ImageMagick: NULL pointer dereference in GetMagickProperty function in MagickCore/property.c

Manifest.toml

A package you depend on has a known security hole (CVE-2018-16329). Fix: Update that package to its patched version.
Serious CVE-2019-19949 ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c

Manifest.toml

A package you depend on has a known security hole (CVE-2019-19949). Fix: Update that package to its patched version.
Serious CVE-2023-34152 ImageMagick: RCE (shell command injection) vulnerability in OpenBlob with --enable-pipes configured

Manifest.toml

A package you depend on has a known security hole (CVE-2023-34152). Fix: Update that package to its patched version.
Serious CVE-2025-53014 ImageMagick: ImageMagick Heap Buffer Overflow

Manifest.toml

A package you depend on has a known security hole (CVE-2025-53014). Fix: Update that package to its patched version.
Serious CVE-2025-53101 ImageMagick: ImageMagick Stack Buffer Overflow

Manifest.toml

A package you depend on has a known security hole (CVE-2025-53101). Fix: Update that package to its patched version.
Serious CVE-2025-57807 imagemagick: ImageMagick BlobStream Forward-Seek Under-Allocation

Manifest.toml

A package you depend on has a known security hole (CVE-2025-57807). Fix: Update that package to its patched version.
Serious CVE-2026-22770 ImageMagick: ImageMagick: Denial of Service due to improper pointer initialization

Manifest.toml

A package you depend on has a known security hole (CVE-2026-22770). Fix: Update that package to its patched version.
Serious CVE-2026-23876 ImageMagick: ImageMagick: Arbitrary code execution via a crafted XBM image file

Manifest.toml

A package you depend on has a known security hole (CVE-2026-23876). Fix: Update that package to its patched version.
Serious CVE-2026-25897 ImageMagick: ImageMagick: Out-of-bounds heap write via integer overflow in sun decoder

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25897). Fix: Update that package to its patched version.
Serious CVE-2026-25898 ImageMagick: ImageMagick: Information disclosure or denial of service via crafted image with invalid pixel index

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25898). Fix: Update that package to its patched version.
Serious CVE-2026-25968 ImageMagick: ImageMagick: Memory corruption via stack buffer overflow when processing an attribute

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25968). Fix: Update that package to its patched version.
Serious CVE-2026-25971 ImageMagick: ImageMagick: Denial of Service via circular references in MSL files

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25971). Fix: Update that package to its patched version.
Serious CVE-2026-25983 ImageMagick: ImageMagick: Denial of service via crafted MSL script

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25983). Fix: Update that package to its patched version.
Serious CVE-2026-25986 ImageMagick: ImageMagick: Denial of Service via malicious YUV image processing

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25986). Fix: Update that package to its patched version.
Serious CVE-2026-25987 ImageMagick: ImageMagick: Memory disclosure and denial of service via crafted MAP files

Manifest.toml

A package you depend on has a known security hole (CVE-2026-25987). Fix: Update that package to its patched version.

… 440 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ none found ✓

Your dependencies cross-checked against the OSV vulnerability database.

Nothing found by this check. ✓

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.