huntabyte/netnotics

API keys, passwords or tokens committed into the repo.

• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  frontend/openapi.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-0286). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-50782 python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-50782). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-69249). Fix: Update that package to its patched version.
• Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
  backend/poetry.lock
  A package you depend on has a known security hole (GHSA-537c-gmf6-5ccf). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-23931 python-cryptography: memory corruption via immutable objects
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-23931). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-49083 python-cryptography: NULL-dereference when loading PKCS7 certificates
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-49083). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-0727 openssl: denial of service via null dereference
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-0727). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-69248). Fix: Update that package to its patched version.
• Worth fixing GHSA-39hc-v87j-747x Vulnerable OpenSSL included in cryptography wheels
  backend/poetry.lock
  A package you depend on has a known security hole (GHSA-39hc-v87j-747x). Fix: Update that package to its patched version.
• Worth fixing GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
  backend/poetry.lock
  A package you depend on has a known security hole (GHSA-h4gh-qq45-vh27). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-29483 dnspython: denial of service in stub resolver
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-29483). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-40899 python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2022-40899). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-40023 python-mako: REDoS in Lexer class
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2022-40023). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41205 mako: Mako: Information disclosure via path traversal vulnerability
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-41205). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44307 mako: Mako: Information disclosure via directory traversal
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-44307). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-48795). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-3772 python-pydantic: regular expression denial of service via crafted email string
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-3772). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-32597). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-48526). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48522 python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-48522). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69277 libsodium: pynacl: libsodium: Improper validation of elliptic curve points could lead to data integrity or information disclosure.
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2025-69277). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
  backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-28684). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-31900). Fix: Update that package to its patched version.
• Serious PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodies
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2025-43859). Fix: Update that package to its patched version.
• Serious GHSA-h8pj-cxx2-jfg2 Improper Input Validation in httpx
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2021-41945). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/requirements-dev.txt
  A package you depend on has a known security hole (CVE-2026-31900). Fix: Update that package to its patched version.
• Serious PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodies
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/requirements-dev.txt
  A package you depend on has a known security hole (CVE-2025-43859). Fix: Update that package to its patched version.
• Serious GHSA-h8pj-cxx2-jfg2 Improper Input Validation in httpx
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/requirements-dev.txt
  A package you depend on has a known security hole (CVE-2021-41945). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/frontend/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-48 Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could e
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-21503). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2121 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics opti
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-32274). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2022-42986 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pur
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-11 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-23931). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-254 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-poin
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-49083). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1283 Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-50782). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1285 Null pointer dereference in PKCS12 parsing
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-0727). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2141 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), Ellip
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child cert
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-34073). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-69249). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2026-69248). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-800 Vulnerable OpenSSL included in cryptography wheels
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-0286). Fix: Update that package to its patched version.
• Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1307 Potential DoS via the Tudoor mechanism in eventlet and dnspython
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2023-29483). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-38 FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` h
  /workdirs/scan-6db82746-19c2-4f12-8336-2cb6afef8696/backend/poetry.lock
  A package you depend on has a known security hole (CVE-2024-24762). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0