Leaderboard github.com
XiaomingX/data-cve-poc-py-v1
这个仓库收集了所有在 GitHub 上能找到的 CVE 漏洞利用工具。 This repository collects all CVE exploits found on GitHub.
phantom-dependency
AI provenance
0%
possible
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
39/100
poor
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
28/100
poor
- Confidence
- 73%
- Coverage
- 86%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% possible
Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts47%
- Estimated AI-generated share0%
- AI tool configuration files2
- Work sessions at AI pace47
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)2.31
Lines added per month all AI-attributed share
- 2026-0222,829 · 0% AI
- 2026-0323,230 · 0% AI
- 2026-0425,656 · 0% AI
- 2026-0524,899 · 0% AI
- 2026-0634,264 · 0% AI
- 2026-0761,995 · 0% AI
- 2026-0834,535 · 0% AI
- 2026-0948,307 · 0% AI
- 2026-1045,655 · 0% AI
- 2026-1119,867 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 284
- effective_loc
- 341,237
- tools_detected
- 0
AI tool configurationok2 items
- 2025/CVE-2025-54136/CLAUDE.md (claude-code configuration)
- 2025/CVE-2025-54136/codex/AGENTS.md (generic-agent configuration)
- artifacts
- 2
- earliest_adoption
- 2026-09-07
- tools_configured
- 2
- workflow_agents
- 0
Commit velocityok15 items
- 12,328 lines of first-party code in ~4.0h (3,082 lines/hour, 1 commit session)
- 7,044 lines of first-party code in ~4.0h (1,761 lines/hour, 1 commit session)
- 6,422 lines of first-party code in ~4.0h (1,606 lines/hour, 1 commit session)
- 5,562 lines of first-party code in ~4.0h (1,390 lines/hour, 1 commit session)
- 5,359 lines of first-party code in ~4.0h (1,340 lines/hour, 1 commit session)
- 5,292 lines of first-party code in ~4.0h (1,323 lines/hour, 1 commit session)
- 4,688 lines of first-party code in ~4.0h (1,172 lines/hour, 1 commit session)
- 4,661 lines of first-party code in ~4.0h (1,165 lines/hour, 1 commit session)
- 4,547 lines of first-party code in ~4.0h (1,137 lines/hour, 1 commit session)
- 4,460 lines of first-party code in ~4.0h (1,115 lines/hour, 1 commit session)
- 4,361 lines of first-party code in ~4.0h (1,090 lines/hour, 1 commit session)
- 4,138 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session)
- 4,004 lines of first-party code in ~4.0h (1,001 lines/hour, 1 commit session)
- 3,667 lines of first-party code in ~4.0h (917 lines/hour, 1 commit session)
- 3,399 lines of first-party code in ~4.0h (850 lines/hour, 1 commit session)
- excluded_import_loc
- 3,288
- flagged_loc
- 161,212
- flagged_loc_share
- 47.7%
- flagged_units
- 47
- max_loc_per_hour
- 3,082
- measured_loc
- 337,949
- median_loc_per_hour
- 228.25
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 266
Release velocityskipped
Coding styleok8 items
- step-by-step narration comment: # Step 1: Create guest cart
- step-by-step narration comment: # Step 2: Upload shell via cart item custom option
- step-by-step narration comment: # Step 3: Find the uploaded shell
- step-by-step narration comment: # Step 1: Create payload file
- step-by-step narration comment: # Step 2: Ensure log dir exists and is writable
- step-by-step narration comment: # Step 3: Remove log file if it exists
- step-by-step narration comment: # Step 4: Create symlink to /etc/passwd
- step-by-step narration comment: # Step 5: Trigger sudo log write via `below`
- count:assistant_voice
- 1
- count:emoji_in_code
- 697
- count:narrated_steps
- 419
- count:placeholder
- 5
- files:assistant_voice
- 1
- files:emoji_in_code
- 72
- files:narrated_steps
- 101
- files:placeholder
- 5
- index
- 2.31
- lines_scanned
- 337,264
- per_kloc:assistant_voice
- 0.00
- per_kloc:emoji_in_code
- 2.07
- per_kloc:narrated_steps
- 1.24
- per_kloc:placeholder
- 0.01
Code quality
39 poor
Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 26% of function code in complex or long functions; 12% duplicated lines. Weakest area: lint.
How the score is built
- Complexity46
- Duplication49
- Lint and smells18
- Tests and CI38
- Documentation40
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- main in 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp: complexity 151, 906 lines
- main in 2025/CVE-2025-58726/ad-autopwn.py: complexity 93, 213 lines
- wmain in 2026/CVE-2026-83991/main_poc.c: complexity 84, 361 lines
- passive_sniff in 2025/CVE-2025-58726/ad-autopwn.py: complexity 83, 209 lines
- run in 2026/CVE-2026-25895/fuxapwn.py: complexity 83, 387 lines
- main in 2026/CVE-2026-4961/src/patch_firmware_v5.py: complexity 82, 388 lines
- main in 2026/CVE-2026-6516/cve-2026-6516-scanner.py: complexity 81, 201 lines
- print_summary in 2025/CVE-2025-58726/ad-autopwn.py: complexity 80, 164 lines
- change_password in 2026/CVE-2026-19632/CVE-2026-19632.py: complexity 77, 132 lines
- check_target in 2026/CVE-2026-6516/cve-2026-6516-scanner.py: complexity 72, 141 lines
- complex_functions
- 549
- function_nloc
- 194,551
- functions
- 9,999
- long_functions
- 160
- many_param_functions
- 104
- mean_ccn
- 4.98
- p90_ccn
- 11
- risky_nloc_share
- 25.6%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: 2025/CVE-2025-10585/poc.py:4 and 2025/CVE-2025-13223/poc.py:4
- 6+ duplicated lines: 2025/CVE-2025-10897/CVE-2025-10897-X7.py:1 and 2026/CVE-2026-10520/CVE-2026-10520-X7.py:1
- 6+ duplicated lines: 2025/CVE-2025-11201/poc.py:43 and 2025/CVE-2025-11201/poc.py:64
- 6+ duplicated lines: 2025/CVE-2025-11740/CVE-2025-11740.py:81 and 2025/CVE-2025-6254/CVE-2025-6254_exploit.py:41
- 6+ duplicated lines: 2025/CVE-2025-1974/exploit.py:37 and 2025/CVE-2025-1974/poc.py:34
- 6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:77 and 2026/CVE-2026-15282/cve_2026_15282.py:65
- 6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:89 and 2026/CVE-2026-13001/cve_2026_13001.py:140
- 6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:108 and 2026/CVE-2026-54390/cve_2026_54390.py:76
- 6+ duplicated lines: 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:540 and 2025/CVE-2025-21333/wnf.h:204
- 6+ duplicated lines: 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:740 and 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:754
- compared_lines
- 263,242
- duplicated_lines
- 30,983
- duplicated_share
- 11.8%
- files
- 1,326
Lintok
- category:best-practice
- 1,271
- category:correctness
- 277
- category:maintainability
- 81
- findings
- 1,629
- scanned_lines
- 332,959
- weighted_findings
- 2,252
Tests and CIok1 item
- CI config: .github/workflows/actions.yml
.github/workflows/actions.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 1
- cochange_commits
- 267
- cochange_share
- 6.4%
- source_lines
- 336,927
- test_lines
- 4,673
- test_ratio
- 0.01
Documentationok1 item
- README.md
README.md
- check:changelog
- no
- check:contributing
- no
- check:license
- no
- check:readme
- yes
- readme_lines
- 35
Type safetyok1 item
- TypeScript strict type checking: 2026/CVE-2026-30849/tsconfig.json
2026/CVE-2026-30849/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 180
- escapes_per_kloc
- 0.66
Security
28 poor
Security posture is poor: 6 possible secret(s) in the tree, 0 only in history; 412 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets1
- Static analysis (SAST)55
- Vulnerable dependenciesnot measured
- CI workflows54
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok2 items
- PyPI: subprocess (declared in 2025/CVE-2025-5781/requirements.txt)
2025/CVE-2025-5781/requirements.txt - PyPI: xml.etree.ElementTree (declared in 2026/CVE-2026-21385/requirements.txt)
2026/CVE-2026-21385/requirements.txt
- checked
- 73
- declared
- 73
- lookup_errors
- 0
- missing
- 2
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 6
- secrets_history
- 0
- secrets_low_confidence
- 19
- secrets_nonprod
- 35
Static analysis (opengrep)ok
- findings
- 965
- findings_high
- 412
- findings_low
- 101
- findings_medium
- 452
- parse_errors
- 49
- scanned_lines
- 332,959
- weighted_findings
- 570.74
Dependencies (osv-scanner)failed
osv-scanner exited 127: workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:4: unknown directive: # | workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:5: go directive expects exactly one argument | extraction failed on specified lockfile
CI workflows (zizmor)ok
- findings
- 4
- findings_high
- 3
- findings_low
- 0
- findings_medium
- 1
- penalty
- 37.20
- workflows
- 1
Security postureok16 items
- 2025/CVE-2025-55319/extension/package.json has no lockfile alongside it (unpinned dependencies)
2025/CVE-2025-55319/extension/package.json - 2026/CVE-2026-102261/go.mod has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-102261/go.mod - 2026/CVE-2026-11417/poc/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-11417/poc/package.json - 2026/CVE-2026-13585/Cargo.toml has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-13585/Cargo.toml - 2026/CVE-2026-21717/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-21717/package.json - 2026/CVE-2026-21877/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-21877/package.json - 2026/CVE-2026-27959/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-27959/package.json - 2026/CVE-2026-30952/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-30952/package.json - 2026/CVE-2026-40176/composer.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-40176/composer.json - 2026/CVE-2026-42167/go.mod has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-42167/go.mod - 2026/CVE-2026-46395/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-46395/package.json - 2026/CVE-2026-46420/attacker/composer.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-46420/attacker/composer.json - 2026/CVE-2026-46420/composer.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-46420/composer.json - 2026/CVE-2026-46490/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-46490/package.json - 2026/CVE-2026-77622/go.mod has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-77622/go.mod - 2026/CVE-2026-85625/package.json has no lockfile alongside it (unpinned dependencies)
2026/CVE-2026-85625/package.json
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 16
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
511 high1 medium54 low
566 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-0282/exploit.py:131 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-0282/exploit.py:162 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-11142/poc.py:104 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-15177/exploit.py:112 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-15177/exploit.py:130 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-1974/exploit.py:615 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-26466/poc.py:138 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-26466/poc.py:195 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-27840/scripts/esp32_undocumented_commands.py:181 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-29009/CVE-2025-29009.py:354 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-29384/poc.py:117 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-32044/cve_2025_32044.py:38 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-32044/cve_2025_32044.py:49 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-32433/CVE-2025-32433.py:103 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-32433/CVE-2025-32433.py:91 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-32433/CVE-2025-32433.py:97 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-34071/PoC.py:168 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-34071/PoC.py:178 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-39401/CVE-2025-39401.py:105 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-39401/CVE-2025-39401.py:130 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-44203/exploit.py:63 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
2025/CVE-2025-48907/CVE-2026-48907.py:181 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-48932/exploit.py:201 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-48932/exploit.py:342 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-48932/exploit.py:385 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-48932/exploit.py:604 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-5781/exploit.py:69 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-57819/cve_2025_57819_aio.py:217 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-57819/cve_2025_57819_aio.py:278 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:1280 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:1321 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:1933 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:1949 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:2173 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:3184 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:3221 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:3441 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:3489 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:4641 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5074 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5108 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5454 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5500 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5612 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-58726/ad-autopwn.py:5643 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6000/CVE-2025-6000.py:355 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6000/CVE-2025-6000.py:381 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6000/CVE-2025-6000.py:386 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6000/CVE-2025-6000.py:388 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6000/CVE-2025-6000.py:438 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-62593/ray_rce_poc.py:127 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-63408/path-traversal.py:77 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6440/poc-exploit.py:207 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-6440/poc-exploit.py:72 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-66034/varlib_cve_2025_66034.py:210 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-68645/CVE-2025-68645.py:29 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-68937/exploit.py:156 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-68937/exploit.py:258 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2025/CVE-2025-69212/CVE-2025-69212.py:25 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0009/poc_path_traversal.py:154 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0009/poc_path_traversal.py:172 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0014/input-leap-directory-traversal-poc.py:318 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-0073/adb_tls_auth_bypass.py:221 | Using 'cf.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'cf.name' is used. Use '.flush()' or close the file before using 'cf.name'. | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-0073/adb_tls_auth_bypass.py:224 | Using 'kf.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'kf.name' is used. Use '.flush()' or close the file before using 'kf.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0300/research_poc.py:108 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0300/research_poc.py:45 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0651/exploit.py:195 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-0776/CVE-2026-0776.py:61 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-104748/CVE-2026-104748.py:161 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-104748/CVE-2026-104748.py:199 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-104748/CVE-2026-104748.py:249 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-104748/CVE-2026-104748.py:333 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-104945/poc_onvif_ptz_oob_write.py:321 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:366 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-105482/cve_2026_105482.py:379 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:395 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:471 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:630 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-105482/cve_2026_105482.py:634 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:671 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-105482/cve_2026_105482.py:703 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-110720/exploit.py:303 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-110720/exploit.py:358 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-110912/CVE-2026-110912-ARPBleed.py:121 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-111967/exploit-cve-2026-111967.py:212 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11499/CVE-2026-11499.py:79 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11551/cve_2026_11551.py:82 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11551/cve_2026_11551.py:895 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11613/poc.py:181 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-119712/CVE-2026-119712.py:225 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11991/CVE-2026-11991-exploit.py:150 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-11991/CVE-2026-11991-exploit.py:216 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
2026/CVE-2026-120490/gcopy_poc.py:32 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-123158/exploit.py:575 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-123158/exploit.py:644 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-123158/exploit.py:743 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:286 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:361 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:502 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:511 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:546 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:557 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:593 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12400/exploit.py:607 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-12485/CVE-2026-12485.py:74 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-126997/poc_cve_2026_126997.py:120 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-126997/poc_cve_2026_126997.py:93 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-13001/cve_2026_13001.py:34 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-13001/cve_2026_13001.py:45 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-1311/CVE-2026-1311.py:555 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-13714/CVE-2026-13714.py:30 | Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'. | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
2026/CVE-2026-14483/CVE-2026-14483.py:179 | Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-15282/cve_2026_15282.py:52 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-15282/cve_2026_15282.py:60 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-15748/cve-2026-15748.py:68 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-15989/antid00t.py:217 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.no-strings-as-booleans |
2026/CVE-2026-15989/antid00t.py:949 | Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-16475/exploit.py:140 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-18649/trigger.py:34 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-18649/trigger.py:47 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19286/poc.py:197 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19295/poc.py:91 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:1030 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:476 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:517 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:547 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:588 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-19949/CVE-2026-19949.py:910 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21014/can_replay_sim.py:17 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21055/exploit.py:122 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21509/CTT-NFS=TEMPORAL-VORTEX v1 CVE-2026-21509.py:228 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21627/CVE-2026-21627.py:214 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21627/CVE-2026-21627.py:650 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21628/CVE-2026-21628.py:549 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21628/CVE-2026-21628.py:561 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.no-strings-as-booleans |
2026/CVE-2026-21628/CVE-2026-21628.py:569 | Using strings as booleans in Python has unexpected results. `"one" and "two"` will return "two". `"one" or "two"` will return "one". In Python, strings are truthy, and strings with a non-zero length evaluate to True. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21628/CVE-2026-21628.py:573 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-21902/watchTowr-vs-JunosEvolved-CVE-2026-21902.py:103 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-23520/poc.py:542 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-23550/CVE-2026-23550.py:86 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-23980/exploit.py:72 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-23980/exploit.py:900 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
2026/CVE-2026-24049/wheelaudit.py:1123 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-24061/twenty-three-scanner.py:979 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-25643/frigate_rce.py:120 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-25807/CVE-2026-25807.py:30 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-25807/CVE-2026-25807.py:43 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-25994/pjsip-cve-2026-25994.py:113 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-26119/wac_rce.py:117 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-26898/xiaomi_ssrf_exploit.py:170 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27097/CVE-2026-27097.py:267 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27180/CVE-2026-27180.py:214 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27384/CVE-2026-27384.py:419 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27384/CVE-2026-27384.py:573 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27384/CVE-2026-27384.py:606 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27540/x.py:106 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27540/x.py:91 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27574/CVE-2026-27574-OneUptime.py:164 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27626/CVE-2026.27626.py:123 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27639/account_takeover/poc_account_takeover.py:235 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27639/privesc/poc_privesc.py:158 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27654/poc.py:201 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-27886/CVE-2026-27886.py:203 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:111 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:94 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:99 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-30/exploit.py:86 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-30332/exploit.py:34 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-31717/exploit.py:504 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-32604/exploit.py:445 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-32604/exploit.py:460 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-32604/exploit.py:483 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-32604/exploit.py:499 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33032/cve-2026-33032-scanner.py:204 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33032/cve-2026-33032-scanner.py:499 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33725/exploit.py:166 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33725/exploit.py:191 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33868/CVE-2026-33868.py:75 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-33868/CVE-2026-33868.py:82 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-34159/linux_exploit_llama.py:325 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-34197/exploit_poc.py:220 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-34197/exploit_poc.py:259 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-34197/exploit_poc.py:276 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3456/race_condition_exploit.py:48 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3456/race_condition_exploit.py:59 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3456/vulnerable_auth_server.py:48 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-34990/exploit.py:261 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-35333/poc.py:161 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-35333/poc.py:168 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3584/mass_scanner.py:201 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3584/mass_scanner.py:335 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.exceptions.raise-not-base-exception |
2026/CVE-2026-36848/exploit.py:121 | In Python3, a runtime `TypeError` will be thrown if you attempt to raise an object or class which does not inherit from `BaseException` | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-36848/exploit.py:85 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-38427/CVE-2026-38427_poc.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-38427/CVE-2026-38427_poc.py:143 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-38427/CVE-2026-38427_poc.py:146 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-38751/poc.py:131 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3888/cve_2026_3888_poc.py:180 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-3891/CVE-2026-3891.py:417 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
2026/CVE-2026-39127/boboverflow.py:139 | time.sleep() call; did you mean to leave this in? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/actions.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/actions.yml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/actions.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-10042/52465.py:29 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-10585/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-11740/CVE-2025-11740.py:153 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-11740/CVE-2025-11740.py:83 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-11740/CVE-2025-11740.py:98 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-12101/CVE_2025-12101.py:135 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-13223/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-13407/CVE-2025-13407.py:117 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-13407/CVE-2025-13407.py:144 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-13407/CVE-2025-13407.py:168 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2025/CVE-2025-1974/exploit.py:129 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2025/CVE-2025-1974/exploit.py:195 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2025/CVE-2025-1974/poc.py:190 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-20720/cve_2025_20720.py:186 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-20720/cve_2025_20720.py:201 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-20720/cve_2025_20720.py:217 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-20720/cve_2025_20720.py:371 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-20720/cve_2025_20720.py:382 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-22224/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-22226/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-24472/exploit.py:85 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-27509/exploit.py:137 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.dangerous-subprocess-use |
2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-29009/CVE-2025-29009.py:140 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-29009/CVE-2025-29009.py:183 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-29009/CVE-2025-29009.py:237 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-30208/CVE-2025-30208.py:130 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-31125/exploit.py:48 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-31125/exploit.py:64 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-31131/exploit.py:45 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-31324/PoC/PoC.py:25 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.flask.security.insecure-deserialization |
2025/CVE-2025-32375/app.py:32 | Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects.... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
2025/CVE-2025-38352/poc_gdb_script.py:113 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
2025/CVE-2025-38352/poc_gdb_script.py:118 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-39401/CVE-2025-39401.py:61 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-39401/CVE-2025-39401.py:96 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2025/CVE-2025-41450/code_of_day.py:43 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2025/CVE-2025-45422/cve-2025-45422.py:4 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-47812/CVE-2025-47812.py:56 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-47812/CVE-2025-47812.py:76 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-47812/CVE-2025-47812.py:93 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-49132/CVE-2025-49132-PoC.py:45 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-49132/CVE-2025-49132-PoC.py:59 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-49132/CVE-2025-49132-PoC.py:84 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-49132/CVE-2025-49132-PoC.py:89 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-54236/blabla.py:125 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-54236/blabla.py:46 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-54236/blabla.py:85 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-54424/CVE-2025-54424.py:76 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-5781/exploit.py:59 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-5781/exploit.py:71 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-5781/exploit.py:89 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | registry.missing-package |
2025/CVE-2025-5781/requirements.txt | PyPI package 'subprocess' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register | Package registries |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-57819/cve_2025_57819_aio.py:271 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-57819/cve_2025_57819_aio.py:286 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-57819/cve_2025_57819_aio.py:56 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-57819/cve_2025_57819_aio.py:79 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-system-call-audit |
2025/CVE-2025-57819/cve_2025_57819_aio.py:95 | Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:2518 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:2566 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:414 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:420 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:431 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:436 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:439 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:459 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:462 | Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:836 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:845 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-58726/ad-autopwn.py:863 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-58726/cmc_addext.py:1253 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-6254/CVE-2025-6254_exploit.py:103 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-6254/CVE-2025-6254_exploit.py:157 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-6254/CVE-2025-6254_exploit.py:43 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-6254/CVE-2025-6254_exploit.py:59 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-6554/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2025/CVE-2025-6558/Dockerfile:21 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-66390/apim_signup.py:111 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-66390/apim_signup.py:52 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-66478/exploit.py:8 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2025/CVE-2025-68645/CVE-2025-68645.py:56 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-68937/exploit.py:182 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-68937/exploit.py:45 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | gitleaks/pkcs12-file |
2025/CVE-2025-69421/malformed-cve-2025-69421.p12 | Possible pkcs12-file secret in the current tree | Secrets (gitleaks) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2025/CVE-2025-7441/CVE-2025-7441.py:87 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0001/smartermail_poc.py:42 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0651/exploit.py:94 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0651/lfd.py:33 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0740/shadow.py:31 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0740/shadow.py:72 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-0776/CVE-2026-0776.py:53 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
2026/CVE-2026-0776/CVE-2026-0776.py:53 | Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-0920/CVE-2026-0920.py:105 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-104748/CVE-2026-104748.py:148 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-105482/cve_2026_105482.py:382 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-105482/cve_2026_105482.py:426 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-105482/cve_2026_105482.py:443 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-105482/cve_2026_105482.py:636 | Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-10795/CVE-2026-10795-mass.py:121 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-108578/poc/poc_cve_2026_108578.py:239 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-108578/poc/poc_cve_2026_108578.py:303 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-109618/php2shell_check_v_1.0.py:43 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-110720/exploit.py:211 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-110720/poc.py:185 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/javascript.express.security.express-vm-injection |
2026/CVE-2026-11114/sandbox_server.js:11 | Make sure that unverified user data can not reach `vm`. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-11120/cicd_build.py:7 | Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2026/CVE-2026-11120/cicd_build.py:7 | Found 'subprocess' function 'check_call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-111497/node2shell_inventory_scanner.py:169 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-11374/cve_2026_11374_check.py:124 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-11387/CVE-2026-11387.py:27 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-114148/poc.py:240 | Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-114713/unrealircd_scanner.py:352 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-114713/unrealircd_scanner.py:361 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-11499/CVE-2026-11499.py:38 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-115560/php2shell_check_v2.0.py:46 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-116512/CVE-2026-116512.py:267 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-116512/CVE-2026-116512.py:283 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-116512/CVE-2026-116512.py:442 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-116512/CVE-2026-116512.py:514 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-116512/CVE-2026-116512.py:521 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-117691/keycloak_saml_scanner.py:261 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-121529/exploit.py:183 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-121529/exploit.py:191 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-121529/verifier.py:136 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-123218/faspex_scanner.py:191 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-123218/faspex_scanner.py:211 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-123218/faspex_scanner.py:228 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-129110/exploit-CVE-2026-129110.py:227 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-129110/exploit-CVE-2026-129110.py:281 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-13001/payload.php:55 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-13714/CVE-2026-13714.py:50 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-13714/CVE-2026-13714.py:89 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-13714/CVE-2026-13714.py:95 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-13753/poc-min.py:107 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.eval-use |
2026/CVE-2026-14894/beelze.php:2 | Evaluating non-constant commands. This can lead to command injection. [confidence low] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.curl-ssl-verifypeer-off |
2026/CVE-2026-1492/CVE-2026-1492.php:39 | SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= false) [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-1555/CVE-2026-1555.py:194 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-16232/CVE-2026-16232.py:23 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-16232/CVE-2026-16232.py:247 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-16232/CVE-2026-16232.py:314 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-16232/CVE-2026-16232.py:331 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-1657/CVE-2026-1657.py:22 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-1657/CVE-2026-1657.py:57 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
2026/CVE-2026-17543/Dockerfile:15 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-18080/exploit.py:146 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-18080/exploit.py:156 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-18080/exploit.py:51 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
2026/CVE-2026-1814/r7creds.py:128 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-1814/r7creds.py:55 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:510 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:647 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:649 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:664 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:666 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:690 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-18143/bp2.php:699 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
2026/CVE-2026-19478/Dockerfile:20 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-19949/CVE-2026-19949.py:26 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests |
2026/CVE-2026-2020/vulnerable_service.py:15 | Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the... | Static analysis (opengrep) |
| high | opengrep/python.flask.security.injection.ssrf-requests |
2026/CVE-2026-2020/vulnerable_service.py:19 | Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-20230/cve-2026-20230.py:29 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-20230/cve-2026-20230.py:57 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-20230/cve-2026-20230.py:91 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-20253/CVE-2026-20253.py:55 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.jwt.security.jwt-python-none-alg |
2026/CVE-2026-21003/exploit_jwt_none.py:5 | Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-21011/log4j_sim.py:12 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2026/CVE-2026-21011/log4j_sim.py:12 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/php.lang.security.file-inclusion |
2026/CVE-2026-21015/vulnerable.php:5 | Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead,... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-21055/analyze_components.py:21 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
2026/CVE-2026-21055/analyze_components.py:31 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-21055/exploit.py:43 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-21385/main.py:4 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | registry.missing-package |
2026/CVE-2026-21385/requirements.txt | PyPI package 'xml.etree.ElementTree' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register | Package registries |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21440/CVE-2026-21440-code.py:19 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21440/CVE-2026-21440-code.py:45 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21440/CVE-2026-21440-code.py:52 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21440/CVE-2026-21440-code.py:60 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-21628/CVE-2026-21628.py:34 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21643/cve_2026_21643.py:50 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21643/cve_2026_21643.py:82 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-21643/cve_2026_21643.py:88 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
2026/CVE-2026-21876/modsec_stand1/flask/Dockerfile:9 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.flask.security.dangerous-template-string |
2026/CVE-2026-21876/modsec_stand1/flask/app.py:49 | Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2026/CVE-2026-22200/Dockerfile:46 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/php.lang.security.exec-use |
2026/CVE-2026-22241/evil.php:1 | Executing non-constant commands. This can lead to command injection. [confidence low] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.injection.echoed-request |
2026/CVE-2026-22241/evil.php:1 | `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.tainted-exec |
2026/CVE-2026-22241/evil.php:1 | Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-22557/CVE-2026-22557.py:51 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-23744/exploit.py:27 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-2413/CVE-2026-2413.py:35 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-2461/CVE20262461.py:7 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2026/CVE-2026-2461/CVE20262461.py:7 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
2026/CVE-2026-24841/靶场.py:236 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-25089/CVE-2026-25089.py:59 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-25676/exploit.py:77 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
2026/CVE-2026-25676/exploit.py:77 | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-25746/exploit.py:4516 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.cryptography.security.crypto-mode-without-authentication |
2026/CVE-2026-26012/poc_decrypt.py:134 | An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM.... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-26114/cve_2026_26114_rce.py:28 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-26221/poc_cve_2026_26221.py:102 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-26335/Calero VeraSMART-RCE.py:220 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-26336/poc.py:32 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27174/scan.py:22 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27626/CVE-2026.27626.py:37 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27626/CVE-2026.27626.py:56 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27636/CVE-2026-27636_PS.py:35 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27876/CVE-2026-27876-check.py:30 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-27876/CVE-2026-27876-check.py:61 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
2026/CVE-2026-27959/Dockerfile:11 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
2026/CVE-2026-28466/CVE-2026-28466.py:31 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/private-key |
2026/CVE-2026-29781/mtls_poc.go:51 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | gitleaks/age-secret-key |
2026/CVE-2026-29781/mtls_poc.go:60 | Possible age-secret-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-30225/exploit.py:64 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/jwt |
2026/CVE-2026-30950/setup/setup.sh:44 | Possible jwt secret in the current tree | Secrets (gitleaks) |
| high | opengrep/dockerfile.security.missing-user-entrypoint |
2026/CVE-2026-3180/dockerfile:30 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-32127/exploit3.py:4530 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3228/CVE-2026-3228.py:484 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/private-key |
2026/CVE-2026-32941/mtls_poc.go:55 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/python.django.security.injection.ssrf.ssrf-injection-requests |
2026/CVE-2026-3333/vulnerable_web_app.py:10 | Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the... | Static analysis (opengrep) |
| high | opengrep/python.flask.security.injection.ssrf-requests |
2026/CVE-2026-3333/vulnerable_web_app.py:15 | Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-33715/poc.py:55 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
2026/CVE-2026-34200/exploit.ts:229 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
2026/CVE-2026-34200/exploit.ts:229 | User controlled data in a `entry.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
2026/CVE-2026-34227/poc.ts:229 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
2026/CVE-2026-34227/poc.ts:229 | User controlled data in a `entry.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-34724/check-CVE-2026-34724.py:22 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-34908/cve_2026_34908_check.py:145 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-35273/CVE-2026-35273.py:92 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-35273/CVE-2026-35273.py:94 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:140 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:154 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:179 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:211 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:271 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3584/mass_scanner.py:65 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3629/CVE-2026-3629.py:40 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3629/CVE-2026-3629.py:55 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3844/CVE-2026-3844.py:147 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3844/CVE-2026-3844.py:69 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-3888/cve_2026_3888_poc.py:136 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3891/CVE-2026-3891.py:163 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-3891/CVE-2026-3891.py:225 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-39987/CVE-2026-39987.py:30 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-39987/CVE-2026-39987.py:43 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.exec-use |
2026/CVE-2026-40176/poc.php:75 | Executing non-constant commands. This can lead to command injection. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-40179/cve-2026-40179-poc.py:84 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-40281/CVE-2026-40281.py:173 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-4112/sma_admin_hash_poc.py:624 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-4112/sma_admin_hash_poc.py:638 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
2026/CVE-2026-41490/poc/poc_partition_sqli.py:147 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
2026/CVE-2026-41490/poc/poc_partition_sqli.py:157 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query |
2026/CVE-2026-41490/poc/poc_partition_sqli.py:177 | Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:107 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:133 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:15 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:30 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:48 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41679/poc.py:78 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-41940/check_session.py:30 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-42208/litellm_scanner.py:47 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-42208/litellm_scanner.py:59 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-42588/CVE-2026-42588_EXP.py:160 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-43503/CVE-2026-43503.py:63 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2026/CVE-2026-43503/CVE-2026-43503.py:63 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44277/CVE-2026-44277.py:43 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44402/CVE-2026-44402.py:133 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44402/CVE-2026-44402.py:144 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44402/CVE-2026-44402.py:149 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44402/CVE-2026-44402.py:157 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.jwt.security.jwt-python-hardcoded-secret |
2026/CVE-2026-4444/exploit_jwt_kid.py:36 | Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g.... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44825/solr_scanner.py:24 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-44825/solr_scanner.py:91 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-44848/portainer_plugin_poc.py:19 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-45498/DefenderScanner.py:14 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-45777/CVE-2026-45777.py:18 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-46300/CVE-2026-46300.py:51 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.subprocess-shell-true |
2026/CVE-2026-46300/CVE-2026-46300.py:51 | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious... | Static analysis (opengrep) |
| high | opengrep/php.lang.security.exec-use |
2026/CVE-2026-46394/poc_git_cmdi.php:277 | Executing non-constant commands. This can lead to command injection. [confidence low] | Static analysis (opengrep) |
| high | opengrep/php.lang.security.exec-use |
2026/CVE-2026-46394/poc_git_cmdi.php:279 | Executing non-constant commands. This can lead to command injection. [confidence low] | Static analysis (opengrep) |
| high | gitleaks/private-key |
2026/CVE-2026-4660/Dockerfile:21 | Possible private-key secret in the current tree | Secrets (gitleaks) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-48282/CVE-2026-48282.py:424 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-48558/poc.py:31 | Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/python.jwt.security.jwt-python-hardcoded-secret |
2026/CVE-2026-48558/poc.py:73 | Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g.... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-48732/poc.py:52 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49009/exploit.py:166 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49009/exploit.py:84 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:151 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:183 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:220 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:251 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:287 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-49777/CVE-2026-49777.py:331 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5027/exploit.py:52 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5027/exploit.py:65 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5027/exploit.py:83 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit |
2026/CVE-2026-50369/reproducer.py:194 | Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an... | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-insecure-websocket |
2026/CVE-2026-5173/CVE-2026-5173.py:14 | Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
2026/CVE-2026-52806/gogs.py:89 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-53571/poc.py:8 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
2026/CVE-2026-53587/CVE-2026-53587.py:26 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/dockerfile.security.missing-user |
2026/CVE-2026-54161/Dockerfile:10 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
2026/CVE-2026-5430/cve_2026_5430_poc.py:150 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5524/CVE-2026-5524.py:123 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5524/CVE-2026-5524.py:181 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5524/CVE-2026-5524.py:241 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.requests.security.disabled-cert-validation |
2026/CVE-2026-5524/CVE-2026-5524.py:267 | Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] | Static analysis (opengrep) |
| medium | zizmor/artipacked |
.github/workflows/actions.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
2025/CVE-2025-0133/cve_2025_0133.py:29 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2025/CVE-2025-20720/README.md:146 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/private-key |
2025/CVE-2025-27636/README.md:97 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2025/CVE-2025-31161/cve-2025-31161.py:45 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/private-key |
2025/CVE-2025-47423/README.md:44 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2025/CVE-2025-48907/README.md:229 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2025/CVE-2025-60800/VULDB_REPORT.md:215 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-1010/exploit_ws_smuggling.py:11 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-109506/README.md:81 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-109506/crack.py:73 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-126997/README.md:66 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/jwt |
2026/CVE-2026-12940/EVIDENCE.txt:10 | Possible jwt secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-13714/CVE-2026-13714.py:13 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-13714/README.md:16 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-16232/ReadMe.md:36 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-1814/r7creds.py:79 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-21847/README.md:56 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-21847/cve_poc_simple.py:18 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-21847/dpdccve_scanner.py:221 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-21847/security-report-dpdatacenter.md:57 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
2026/CVE-2026-22038/README.md:102 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-22038/README.md:68 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
2026/CVE-2026-25232/README.md:57 | Possible curl-auth-user secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-28466/CVE-2026-28466.py:33 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-30/exploit.py:96 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-30944/README.md:175 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-30945/README.md:194 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-32096/exploit.sh:58 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-32255/README.md:150 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-32255/internal-service.py:24 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-35585/data/filebrowser.db:3 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
2026/CVE-2026-39842/README.md:553 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-42568/README.md:46 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-44578/README.md:33 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-44578/verify_ghsa_c4j6.py:114 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
2026/CVE-2026-44825/README.md:280 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-46376/README.md:88 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/jwt |
2026/CVE-2026-47670/README.md:42 | Possible jwt secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
2026/CVE-2026-47670/README.md:45 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-5465/README.md:168 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-55579/ANALYSIS.md:21 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-55579/EVIDENCE.md:94 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-55579/README.md:44 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-56290/README.md:259 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-57517/cve_2026_57517.py:296 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/curl-auth-header |
2026/CVE-2026-59734/README.md:177 | Possible curl-auth-header secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-61628/CVE-2026-61628-Abraxas-Labs.py:236 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/curl-auth-user |
2026/CVE-2026-76904/README.md:115 | Possible curl-auth-user secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/private-key |
2026/CVE-2026-79551/README.md:89 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-86259/README.md:51 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-89026/cve-2026-89026-issabel-pbxapi-jwt-rce.py:40 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-9090/CVE-2026-9090.py:144 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-9198/README.md:55 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
2026/CVE-2026-94609/CVE-2026-94609.py:161 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 4 | |
| Dependencies (osv-scanner) | Security | failed | — | 0 | osv-scanner exited 127: workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:4: unknown directive: # | workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:5: go directive expects exactly one argument | extraction failed on specified lockfile |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 2 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 60 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 022616bacf6f | prov-5+qual-2+sec-2 | 0% | 39 | 28 |
| 2026-11-14 | 022616bacf6f | prov-4+qual-2+sec-2 | 0% | 39 | 28 |
Full text report
- Repository: https://github.com/XiaomingX/data-cve-poc-py-v1
- Commit:
022616bacf6f9d441812532ec51086faa1bb30c1 - Generated: 2026-11-14T14:52:02+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
Phantom dependency: a declared package does not exist on its public registry. If it isn't a private package, anyone could register that name and have their code installed (slopsquatting). See the security findings.
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 39 | poor | 90% | 100% |
| Security | 28 | poor | 73% | 86% |
AI provenance
Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 47.2%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: claude-code, generic-agent
-
Stylometry index: 2.31 per 1,000 lines (narrated steps 419, placeholders 5, assistant phrasing 1, emoji 697). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-02 | 22,829 | 0% |
| 2026-03 | 23,230 | 0% |
| 2026-04 | 25,656 | 0% |
| 2026-05 | 24,899 | 0% |
| 2026-06 | 34,264 | 0% |
| 2026-07 | 61,995 | 0% |
| 2026-08 | 34,535 | 0% |
| 2026-09 | 48,307 | 0% |
| 2026-10 | 45,655 | 0% |
| 2026-11 | 19,867 | 0% |
Evidence
- 12,328 lines of first-party code in ~4.0h (3,082 lines/hour, 1 commit session) (c7d9de2be383)
- 7,044 lines of first-party code in ~4.0h (1,761 lines/hour, 1 commit session) (e4a01918d4b1)
- 2025/CVE-2025-54136/CLAUDE.md (claude-code configuration) (2025/CVE-202)
- 2025/CVE-2025-54136/codex/AGENTS.md (generic-agent configuration) (2025/CVE-202)
- 6,422 lines of first-party code in ~4.0h (1,606 lines/hour, 1 commit session) (ffead547663c)
- 5,562 lines of first-party code in ~4.0h (1,390 lines/hour, 1 commit session) (d6f8cf93d71f)
- 5,359 lines of first-party code in ~4.0h (1,340 lines/hour, 1 commit session) (d0b69bec18c4)
- 5,292 lines of first-party code in ~4.0h (1,323 lines/hour, 1 commit session) (18457e658b2a)
- 4,688 lines of first-party code in ~4.0h (1,172 lines/hour, 1 commit session) (077341445ebb)
- 4,661 lines of first-party code in ~4.0h (1,165 lines/hour, 1 commit session) (cf51080b7472)
- 4,547 lines of first-party code in ~4.0h (1,137 lines/hour, 1 commit session) (e23213dce4a3)
- 4,460 lines of first-party code in ~4.0h (1,115 lines/hour, 1 commit session) (7b32b765ab7e)
- 4,361 lines of first-party code in ~4.0h (1,090 lines/hour, 1 commit session) (7e0b3da7cf09)
- 4,138 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session) (794887e3d1ab)
- 4,004 lines of first-party code in ~4.0h (1,001 lines/hour, 1 commit session) (7089889a8238)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 26% of function code in complex or long functions; 12% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 46 |
| Duplication | 49 |
| Code smells (Opengrep) | 18 |
| Tests and CI | 38 |
| Documentation | 40 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 9,999; mean complexity 5.0, 90th percentile 11; 549 complex and 160 long functions
- Duplicated lines: 11.8% of 263,242 compared
- Tests: 4,673 test lines for 336,927 source lines (ratio 0.01); CI test commands: none detected; 6% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- main in 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp: complexity 151, 906 lines
- main in 2025/CVE-2025-58726/ad-autopwn.py: complexity 93, 213 lines
- wmain in 2026/CVE-2026-83991/main_poc.c: complexity 84, 361 lines
- passive_sniff in 2025/CVE-2025-58726/ad-autopwn.py: complexity 83, 209 lines
- run in 2026/CVE-2026-25895/fuxapwn.py: complexity 83, 387 lines
Security
Security posture is poor: 6 possible secret(s) in the tree, 0 only in history; 412 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 1 |
| Static analysis (Opengrep) | 55 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 54 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | registry.missing-package: PyPI package 'subprocess' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register |
2025/CVE-2025-5781/requirements.txt |
| high | registry.missing-package: PyPI package 'xml.etree.ElementTree' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register |
2026/CVE-2026-21385/requirements.txt |
| high | gitleaks/pkcs12-file: Possible pkcs12-file secret in the current tree |
2025/CVE-2025-69421/malformed-cve-2025-69421.p12 |
| high | gitleaks/age-secret-key: Possible age-secret-key secret in the current tree |
2026/CVE-2026-29781/mtls_poc.go:60 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
2026/CVE-2026-29781/mtls_poc.go:51 |
| high | gitleaks/jwt: Possible jwt secret in the current tree |
2026/CVE-2026-30950/setup/setup.sh:44 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
2026/CVE-2026-32941/mtls_poc.go:55 |
| high | gitleaks/private-key: Possible private-key secret in the current tree |
2026/CVE-2026-4660/Dockerfile:21 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-10042/52465.py:29 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
2025/CVE-2025-10585/Dockerfile:21 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-11740/CVE-2025-11740.py:83 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-11740/CVE-2025-11740.py:98 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-11740/CVE-2025-11740.py:153 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-12101/CVE_2025-12101.py:135 |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
2025/CVE-2025-13223/Dockerfile:21 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-13407/CVE-2025-13407.py:117 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-13407/CVE-2025-13407.py:144 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-13407/CVE-2025-13407.py:168 |
| high | opengrep/python.lang.security.unverified-ssl-context: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] |
2025/CVE-2025-1974/exploit.py:129 |
| high | opengrep/python.lang.security.unverified-ssl-context: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] |
2025/CVE-2025-1974/exploit.py:195 |
| high | opengrep/python.lang.security.unverified-ssl-context: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] |
2025/CVE-2025-1974/poc.py:190 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-20720/cve_2025_20720.py:186 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-20720/cve_2025_20720.py:201 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-20720/cve_2025_20720.py:217 |
| high | opengrep/python.requests.security.disabled-cert-validation: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low] |
2025/CVE-2025-20720/cve_2025_20720.py:371 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Dependency registry checks
73 declared packages checked: 2 not found on their registry, 0 first published in the last 30 days.
- missing-package: PyPI: subprocess (declared in 2025/CVE-2025-5781/requirements.txt)
- missing-package: PyPI: xml.etree.ElementTree (declared in 2026/CVE-2026-21385/requirements.txt)
A missing package may be private. If it isn't, the name is unclaimed and anyone could publish code under it.
Repository profile
- Source lines: 336,927; test lines: 4,673
| Language | Lines |
|---|---|
| Python | 277,698 |
| C | 27,658 |
| Shell | 12,025 |
| JavaScript | 5,982 |
| C++ | 4,352 |
| PHP | 3,917 |
| Go | 2,341 |
| Objective-C | 1,924 |
| PowerShell | 1,764 |
| TypeScript | 1,580 |
Coverage gaps
sec-deps: osv-scanner exited 127: workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:4: unknown directive: # | workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:5: go directive expects exactly one argument | extraction failed on specified lockfile