gitsafehub
github.com/fzambia/django_real_time_game_tutorial ↗

fzambia/django_real_time_game_tutorial

scanned 2026-08-12 · git ed283ad
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies24Known OSS vulnerabilities48Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 24 found · 5 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2016-9013 python-django: user with hardcoded password created when running tests on Oracle
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-9013). Fix: Update that package to its patched version.
  • Serious CVE-2016-9014 python-django: DNS rebinding vulnerability when 'DEBUG=True'
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-9014). Fix: Update that package to its patched version.
  • Serious CVE-2019-19844 Django: crafted email address allows account takeover
    requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-2048 python-django: user with "change" but not "add" permission can create objects for ModelAdmin
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-2048). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-7401 python-django: CSRF protection bypass on a site with Google Analytics
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-7401). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-2512 python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-2512). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-6186 django: XSS in admin's add/change related popup
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-6186). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-7233 python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-7233). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-7234 python-django: Open redirect vulnerability in django.views.static.serve()
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-7234). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33203 django: Potential directory traversal via ``admindocs``
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48432 django: Django Path Injection Vulnerability
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Minor CVE-2016-2513 python-django: User enumeration through timing difference on password hasher work factor upgrade
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-2513). Fix: Update that package to its patched version.
  • Minor CVE-2026-48587 django: Django: Information disclosure via improper handling of Vary header whitespace
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-48587). Fix: Update that package to its patched version.
  • Minor CVE-2026-48588 django: Django: Information disclosure due to improper caching of Set-Cookie responses
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-48588). Fix: Update that package to its patched version.
  • Minor CVE-2026-6873 python-django: Django: Information disclosure via non-injective cookie salt derivation
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-6873). Fix: Update that package to its patched version.
  • Minor CVE-2026-8404 Django: Django: Information disclosure due to improper handling of Cache-Control directives
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-8404). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 48 found · 10 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2016-17 Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easi
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9013). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-18 Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9014). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-17 Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easi
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9013). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-18 Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9014). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-14 Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option w
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-2048). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-15 The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cro
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-2512). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-2 Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-6186). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-3 The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-7401). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-10 A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2017-7234). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-9 Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``dja
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2017-7233). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerability
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8x94-hmjh-97hq Django vulnerable to Reflected File Download attack
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-14 Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option w
    /workdirs/scan-ae056e47-07c9-4cce-ba91-1ffa77be6db4/requirements.txt
    A package you depend on has a known security hole (CVE-2016-2048). Fix: Update that package to its patched version.
… 23 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.