Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
CVE-2021-35042 django: potential SQL injection via unsanitized QuerySet.order_by() inputCVE-2025-64459 django: Django SQL injectionCVE-2021-34552 python-pillow: Buffer overflow in image convert functionCVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressionsCVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameterCVE-2021-31542 django: Potential directory-traversal via uploaded filesCVE-2021-33571 django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addressesCVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliasesCVE-2025-64458 Django: Denial-of-service vulnerability in Django on WindowsCVE-2021-28658 django: potential directory-traversal via uploaded filesCVE-2021-32052 django: header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+CVE-2021-33203 django: Potential directory traversal via ``admindocs``CVE-2021-44420 django: potential bypass of an upstream access control based on URL pathsCVE-2024-45231 python-django: Potential user email enumeration via response status on password resetCVE-2025-48432 django: Django Path Injection VulnerabilityCVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRasterCVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlinesCVE-2025-69534 python-markdown: denial of service via malformed HTML-like sequencesCVE-2021-23437 python-pillow: possible ReDoS via the getrgb functionCVE-2021-25287 python-pillow: Out-of-bounds read in J2K image readerCVE-2021-25288 python-pillow: Out-of-bounds read in J2K image readerCVE-2021-25291 python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.cCVE-2021-27921 python-pillow: Excessive memory allocation in BLP image readerCVE-2021-27922 python-pillow: Excessive memory allocation in ICNS image readerYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.PYSEC-2026-457 Arbitrary Code Execution in PillowPYSEC-2026-2102 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in respPYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.PYSEC-2026-457 Arbitrary Code Execution in PillowPYSEC-2021-439 In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.PYSEC-2021-6 In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were notPYSEC-2021-7 In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.PYSEC-2021-8 In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existPYSEC-2021-99 In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This maPYSEC-2026-1297 Django allows enumeration of user e-mail addressesGHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliasesCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
guarddog-pypi-shady-links shady-links match in discord.py 1.6.0A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.