Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-33034 Django: Django: Denial of Service via missing or understated Content-Length header in ASGI requestsCVE-2026-3902 Django: Django: Header spoofing via ambiguous header mappingCVE-2026-33033 Django: Django: Performance degradation via excessive whitespace in multipart uploadsCVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRasterCVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlinesCVE-2026-5766 django: Django: Service degradation via understated Content-Length header in ASGI requestsCVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handlingCVE-2026-35523 strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocolCVE-2026-35526 strawberry-graphql: Denial of Service via unbounded WebSocket subscriptionsCVE-2026-47706 Strawberry GraphQL has a Circular Fragment Reference DOSCVE-2026-47707 Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationCVE-2026-35192 Django: Django: Session theft due to improper cookie handling with cached pagesCVE-2026-35193 django: Django: Information disclosure due to improper caching of authenticated responsesCVE-2026-4277 Django: Django: Privilege Abuse via Forged POST Data in GenericInlineModelAdminCVE-2026-4292 Django: Django: Unauthorized instance creation via forged POST data in Admin changelist formsCVE-2026-48587 django: Django: Information disclosure via improper handling of Vary header whitespaceCVE-2026-48588 django: Django: Information disclosure due to improper caching of Set-Cookie responsesCVE-2026-6873 python-django: Django: Information disclosure via non-injective cookie salt derivationCVE-2026-6907 django: Django: Information Disclosure via erroneous caching of Vary header with asteriskCVE-2026-7666 django: Django: Information disclosure via failed STARTTLS handshake in EmailBackendCVE-2026-8404 Django: Django: Information disclosure due to improper handling of Cache-Control directivesCVE-2026-4539 pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexerCVE-2026-45739 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLsYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-52 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
Add permissions on inline model instances were not validated on submission of
forged `POST` data in `GenericInlinPYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2026-198 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header valPYSEC-2026-199 An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and PYSEC-2026-201 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitivelPYSEC-2026-2090 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carriePYSEC-2026-2091 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose PYSEC-2026-2092 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newliPYSEC-2026-48 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-TrPYSEC-2026-49 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
ASGI requests with a missing or understated `Content-Length` header could
bypass the `DATA_UPLOAD_MAX_MEMORY_SIZEPYSEC-2026-50 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker cPYSEC-2026-51 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
`ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variantsPYSEC-2026-54 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially lPYSEC-2026-55 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). ThPYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorPYSEC-2026-1845 pytest has vulnerable tmpdir handlingPYSEC-2026-161 BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checksPYSEC-2026-2280 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attrPYSEC-2026-2281 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to iPYSEC-2026-248 Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating PYSEC-2026-249 Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are ePYSEC-2026-133 Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subpPYSEC-2026-134 Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols alloPYSEC-2026-2282 Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URPYSEC-2026-2283 Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detectioCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.