Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
CVE-2023-37920 python-certifi: Removal of e-Tugra root certificateCVE-2023-38325 python-cryptography: SSH certificate encoding/parsing incompatibility with OpenSSHCVE-2023-50782 python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659CVE-2024-26130 python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideCVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsCVE-2023-49083 python-cryptography: NULL-dereference when loading PKCS7 certificatesCVE-2024-0727 openssl: denial of service via null dereferenceCVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheelsCVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie headerCVE-2024-6221 A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Ac ...CVE-2024-1681 corydolphin/flask-cors is vulnerable to log injection when the log lev ...CVE-2024-6839 corydolphin/flask-cors version 4.0.1 contains an improper regex path m ...CVE-2024-6844 A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inc ...CVE-2024-6866 corydolphin/flask-cors version 4.01 contains a vulnerability where the ...CVE-2024-1135 python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headersCVE-2024-6827 gunicorn: HTTP Request Smuggling in benoitc/gunicornCVE-2026-59939 httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodiesCVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filterCVE-2024-34064 jinja2: accepts keys containing non-attribute charactersCVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenamesYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-2269 pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed purPYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2023-112 The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.PYSEC-2023-254 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-poinPYSEC-2024-225 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificatePYSEC-2026-1283 Python Cryptography package vulnerable to Bleichenbacher timing oracle attackPYSEC-2026-1285 Null pointer dereference in PKCS12 parsingPYSEC-2026-2141 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipPYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certPYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingPYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsPYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxyPYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a UsPYSEC-2024-271 corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containinPYSEC-2024-71 A vulnerability in corydolphin/flask-cors up to version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavioPYSEC-2026-1383 Flask-CORS vulnerable to Improper Handling of Case SensitivityPYSEC-2026-1384 Flask-CORS improper regex path matching vulnerabilityPYSEC-2026-1385 Flask-CORS allows for inconsistent CORS matchingPYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerabilityPYSEC-2026-1434 Request smuggling leading to endpoint restriction bypass in GunicornPYSEC-2026-3444 httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompPYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.