Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
CVE-2019-14234 Django: SQL injection possibility in key and index lookups for JSONField/HStoreFieldCVE-2019-19844 Django: crafted email address allows account takeoverCVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)CVE-2025-64459 django: Django SQL injectionCVE-2019-14232 Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoSCVE-2019-14233 Django: the behavior of the underlying HTMLParser leading to DoSCVE-2019-14235 Django: Potential memory exhaustion in django.utils.encoding.uri_to_iri()CVE-2019-3498 python-django: Content spoofing via URL path in default 404 pageCVE-2019-6975 python-django: memory exhaustion in django.utils.numberformat.format()CVE-2020-9402 django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on OracleCVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliasesCVE-2025-64458 Django: Denial-of-service vulnerability in Django on WindowsCVE-2017-12794 python-django: Possible XSS in traceback section of technical 500 debug pageCVE-2018-14574 django: Open redirect possibility in CommonMiddlewareCVE-2018-7536 django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc'CVE-2019-12308 django: missing URL validation by AdminURLFieldWidget leads to generation of clickable unsafe JavaScript link causing cross site scriptingCVE-2019-12781 Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPSCVE-2021-33203 django: Potential directory traversal via ``admindocs``CVE-2024-45231 python-django: Potential user email enumeration via response status on password resetCVE-2025-48432 django: Django Path Injection VulnerabilityCVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRasterCVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlinesCVE-2018-7537 django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html'CVE-2026-48587 django: Django: Information disclosure via improper handling of Vary header whitespaceYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2019-13 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fPYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of PYSEC-2020-35 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data aGHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.PYSEC-2017-44 In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a croPYSEC-2018-2 django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.PYSEC-2018-5 An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophiPYSEC-2018-6 An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they wePYSEC-2019-10 An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settPYSEC-2019-11 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, tPYSEC-2019-12 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremelyPYSEC-2019-14 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage PYSEC-2019-17 In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defauPYSEC-2019-18 Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() functPYSEC-2019-79 An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without PYSEC-2020-36 Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitPYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existPYSEC-2026-1297 Django allows enumeration of user e-mail addressesGHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliasesGHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerabilityGHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injectionGHSA-8x94-hmjh-97hq Django vulnerable to Reflected File Download attackGHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytesGHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsPYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to disCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.