gitsafehub
github.com/linkvt/repo-classifier ↗

linkvt/repo-classifier

scanned 2026-08-12 · git 6492dc9
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies42Known OSS vulnerabilities67Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Vulnerable dependencies — Trivyⓘ 42 found · 6 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2019-19844 Django: crafted email address allows account takeover
    requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious CVE-2019-6446 numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution
    requirements.txt
    A package you depend on has a known security hole (CVE-2019-6446). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-12794 python-django: Possible XSS in traceback section of technical 500 debug page
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-12794). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-7233 python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-7233). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-7234 python-django: Open redirect vulnerability in django.views.static.serve()
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-7234). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33203 django: Potential directory traversal via ``admindocs``
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48432 django: Django Path Injection Vulnerability
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-12852 numpy: Missing input validation on empty list or ndarray in numpy.pad function
    requirements.txt
    A package you depend on has a known security hole (CVE-2017-12852). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-41495 numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-41495). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33430 numpy: buffer overflow in the PyArray_NewFromDescr_int() in ctors.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-34141 numpy: incomplete string comparison in the numpy.core component
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-34141). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-41496 numpy: buffer overflow in the array_from_pyobj() in fortranobject.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-41496). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
    requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
… 17 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 67 found · 12 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-108 ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2019-6446). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-107 ** DISPUTED ** scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2020-13092). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-10 A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-7234). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-44 In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cro
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-12794). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-9 Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``dja
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-7233). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerability
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8x94-hmjh-97hq Django vulnerable to Reflected File Download attack
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2017-1 The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2017-12852). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-856 Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks
    /workdirs/scan-fe9ef184-856e-4ae1-8247-c5377f6adae1/requirements.txt
    A package you depend on has a known security hole (CVE-2021-41495). Fix: Update that package to its patched version.
… 42 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.