gitsafehub
github.com/vladenisov/socceraction ↗

vladenisov/socceraction

scanned 2026-08-13 · git 4651702
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies24Known OSS vulnerabilities70Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Vulnerable dependencies — Trivyⓘ 24 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2022-21797 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-21797). Fix: Update that package to its patched version.
  • Serious CVE-2023-47248 PyArrow: Arbitrary code execution when loading a malicious data file
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-23491 python-certifi: untrusted root certificates
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41066 lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-41066). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-2309 lxml: NULL Pointer Dereference in lxml
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-2309). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-34141 numpy: incomplete string comparison in the numpy.core component
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-34141). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-3772 python-pydantic: regular expression denial of service via crafted email string
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-3772). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-5206 scikit-learn: Possible sensitive data leak
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-5206). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-43804 python-urllib3: Cookie request header isn't stripped during cross-origin redirects
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44431 urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-45803 urllib3: Request body not stripped after redirect from 303 status changes request method to GET
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-37891 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
  • Minor CVE-2024-39689 python-certifi: Remove root certificates from `GLOBALTRUST` from the root store
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 70 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2026-31900). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-288 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2022-21797). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-163 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2023-39631). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-238 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Serious PYSEC-2024-187 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-53899). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-117 A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2022-40896). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to dis
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/docs/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-48 Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could e
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-21503). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2121 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics opti
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2026-32274). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-42986 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pur
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1374 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2026-22701). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1375 filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2025-68146). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1472 Jinja has a sandbox breakout through malicious filenames
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-2de23207-a2f7-463c-8ea7-578120b872d0/poetry.lock
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
… 45 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.