howl-anderson/keras-nlp

scanned 2026-08-14 · git a02e93e

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities42Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 42 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious PYSEC-2026-548 TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25668). Fix: Update that package to its patched version.
Serious PYSEC-2026-1486 Keras Directory Traversal Vulnerability

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2025-12060). Fix: Update that package to its patched version.
Serious PYSEC-2026-369 Keras code injection vulnerability

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2024-3660). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3098 TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25670). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3106 TensorFlow has Null Pointer Error in SparseSparseMaximum

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25665). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3111 TensorFlow has Floating Point Exception in TFLite in conv kernel

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-27579). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3115 TensorFlow has Floating Point Exception in TensorListSplit with XLA

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25673). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3116 TensorFlow has Null Pointer Error in TensorArrayConcatV2

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25663). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3120 TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25658). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3122 TensorFlow has Heap-buffer-overflow in AvgPoolGrad

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25664). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3123 TensorFlow has null dereference on ParallelConcat with XLA

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25676). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3130 TensorFlow vulnerable to integer overflow in EditDistance

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25662). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3131 TensorFlow has Segfault in Bincount with XLA

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25675). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3142 TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25659). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3143 TensorFlow has Null Pointer Error in LookupTableImportV2

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25672). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3166 TensorFlow has double free in Fractional(Max/Avg)Pool

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25801). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3169 TensorFlow has Floating Point Exception in AudioSpectrogram

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25666). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3176 TensorFlow vulnerable to segfault when opening multiframe gif

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25667). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3182 TensorFlow Denial of Service vulnerability

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25661). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3189 TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25674). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3190 TensorFlow has segfault in array_ops.upper_bound

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-33976). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3206 TensorFlow has segmentation fault in tfg-translate

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25671). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3231 TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25660). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3236 TensorFlow has Floating Point Exception in AvgPoolGrad with XLA

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2023-25669). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior

/workdirs/scan-f84064ef-d27d-447b-8e3e-04ee38740adf/.cloudbuild/requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.

… 17 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.