all missions

2 repos indexed1 skipped…

Every open mission across every indexed repo, one list. Looking for one repo? Browse repos instead.

Impact

Ecosystem

Effort

Type

Group by repoSort

1–50 of 184 missions

Critical
Update urllib3 to fix a critical vulnerability(GHSA-www2)
Fix: 1.239.6/10
Exposure of Sensitive Information to an Unauthorized Actor in urllib3 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: critical (CVSS 9.8). Reported via GHSA-www2-v7xj-xrc6 (GHSA).
Upgrade urllib3 to 1.23 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.8) + 0.40 × ecosystem value (9.4) = 9.6
Impact inputs
CVSS: 9.8
Severity: critical
Dependency type: production
Advisory age: 2817d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-www2-v7xj-xrc6 for urllib3
High
Update urllib3 to fix a high vulnerability(PYSEC-2023)
Fix: 2.0.68.6/10
Advisory PYSEC-2023-192 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 8.1). Reported via PYSEC-2023-192 (OSV).
Upgrade urllib3 to 2.0.6 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (8.1) + 0.40 × ecosystem value (9.4) = 8.6
Impact inputs
CVSS: 8.1
Severity: high
Dependency type: production
Advisory age: 1060d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2023-192 for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-q2q7)
Fix: 1.26.58.3/10
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-q2q7-5pp4-w6pg (GHSA).
Upgrade urllib3 to 1.26.5 or later — trivial effort (patch version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1915d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-q2q7-5pp4-w6pg for urllib3
High
Update certifi to fix a high vulnerability(GHSA-xqr8)
Fix: 2023.7.228.3/10
Removal of e-Tugra root certificate certifi is declared as ">=2023.5.7" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-xqr8-7jwr-rhp7 (GHSA).
Upgrade certifi to 2023.7.22 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1131d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-xqr8-7jwr-rhp7 for certifi
High
Update urllib3 to fix a high vulnerability(GHSA-hmv2)
Fix: 1.25.88.3/10
Uncontrolled Resource Consumption in urllib3 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-hmv2-79q8-fv6g (GHSA).
Upgrade urllib3 to 1.25.8 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 1947d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-hmv2-79q8-fv6g for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-mh33)
Fix: 1.24.28.3/10
Improper Certificate Validation in urllib3 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-mh33-7rrq-662w (GHSA).
Upgrade urllib3 to 1.24.2 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 2689d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-mh33-7rrq-662w for urllib3
High
Update urllib3 to fix a high vulnerability(PYSEC-2026)
Fix: 2.6.38.3/10
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via PYSEC-2026-1996 (OSV).
Upgrade urllib3 to 2.6.3 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 53d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-1996 for urllib3
High
Update urllib3 to fix a high vulnerability(PYSEC-2026)
Fix: 2.7.08.3/10
Advisory PYSEC-2026-142 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via PYSEC-2026-142 (OSV).
Upgrade urllib3 to 2.7.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 108d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-142 for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-mf9v)
Fix: 2.7.08.3/10
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-mf9v-mfxr-j63j (GHSA).
Upgrade urllib3 to 2.7.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 110d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-mf9v-mfxr-j63j for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-38jv)
Fix: 2.6.38.3/10
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-38jv-5279-wg99 (GHSA).
Upgrade urllib3 to 2.6.3 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 234d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-38jv-5279-wg99 for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-2xpw)
Fix: 2.6.08.0/10
urllib3 streaming API improperly handles highly compressed data urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high. Reported via GHSA-2xpw-w6gg-jr37 (GHSA).
Upgrade urllib3 to 2.6.0 or later — medium effort (major version bump).
⚠ Low confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (9.4) = 8.0
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 267d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
Source
GHSA advisory GHSA-2xpw-w6gg-jr37 for urllib3
High
Update urllib3 to fix a high vulnerability(GHSA-gm62)
Fix: 2.6.08.0/10
urllib3 allows an unbounded number of links in the decompression chain urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: high. Reported via GHSA-gm62-xv2j-4w53 (GHSA).
Upgrade urllib3 to 2.6.0 or later — medium effort (major version bump).
⚠ Low confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (9.4) = 8.0
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 267d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
Source
GHSA advisory GHSA-gm62-xv2j-4w53 for urllib3
High
Update idna to fix a high vulnerability(PYSEC-2024)
Fix: 3.78.3/10
Advisory PYSEC-2024-60 idna is declared as ">=2.5,<4" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via PYSEC-2024-60 (OSV).
Upgrade idna to 3.7 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 783d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2024-60 for idna
High
Update certifi to fix a high vulnerability(PYSEC-2024)
Fix: 2024.7.48.3/10
Advisory PYSEC-2024-230 certifi is declared as ">=2023.5.7" and used as a production PyPI dependency of this repo. Severity: high (CVSS 7.5). Reported via PYSEC-2024-230 (OSV).
Upgrade certifi to 2024.7.4 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (9.4) = 8.3
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 785d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2024-230 for certifi
Medium
Update urllib3 to fix a medium vulnerability(GHSA-5phf)
Fix: 1.26.47.7/10
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.5). Reported via GHSA-5phf-pp7p-vc2r (GHSA).
Upgrade urllib3 to 1.26.4 or later — trivial effort (patch version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.5) + 0.40 × ecosystem value (9.4) = 7.7
Impact inputs
CVSS: 6.5
Severity: medium
Dependency type: production
Advisory age: 1989d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-5phf-pp7p-vc2r for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-wqvq)
Fix: 1.25.97.7/10
CRLF injection in urllib3 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.5). Reported via GHSA-wqvq-5m8c-6g24 (GHSA).
Upgrade urllib3 to 1.25.9 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.5) + 0.40 × ecosystem value (9.4) = 7.7
Impact inputs
CVSS: 6.5
Severity: medium
Dependency type: production
Advisory age: 1898d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-wqvq-5m8c-6g24 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-v845)
Fix: 2.0.67.6/10
`Cookie` HTTP header isn't stripped on cross-origin redirects urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.4). Reported via GHSA-v845-jxx5-vc9f (GHSA).
Upgrade urllib3 to 2.0.6 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.4) + 0.40 × ecosystem value (9.4) = 7.6
Impact inputs
CVSS: 6.4
Severity: medium
Dependency type: production
Advisory age: 1062d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-v845-jxx5-vc9f for urllib3
Medium
Update idna to fix a medium vulnerability(GHSA-jjg7)
Fix: 3.77.5/10
Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode idna is declared as ">=2.5,<4" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.2). Reported via GHSA-jjg7-2v4v-x38h (GHSA).
Upgrade idna to 3.7 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.2) + 0.40 × ecosystem value (9.4) = 7.5
Impact inputs
CVSS: 6.2
Severity: medium
Dependency type: production
Advisory age: 870d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-jjg7-2v4v-x38h for idna
Medium
Update urllib3 to fix a medium vulnerability(GHSA-gwvm)
Fix: 1.24.27.4/10
Authorization Header forwarded on redirect urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.1). Reported via GHSA-gwvm-45gx-3cf8 (GHSA).
Upgrade urllib3 to 1.24.2 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.1) + 0.40 × ecosystem value (9.4) = 7.4
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: production
Advisory age: 1049d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-gwvm-45gx-3cf8 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2023)
Fix: 1.24.27.4/10
Advisory PYSEC-2023-207 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.1). Reported via PYSEC-2023-207 (OSV).
Upgrade urllib3 to 1.24.2 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.1) + 0.40 × ecosystem value (9.4) = 7.4
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: production
Advisory age: 1049d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2023-207 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-r64q)
Fix: 1.24.37.4/10
Improper Neutralization of CRLF Sequences in urllib3 library for Python urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 6.1). Reported via GHSA-r64q-w8jr-g9qp (GHSA).
Upgrade urllib3 to 1.24.3 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.1) + 0.40 × ecosystem value (9.4) = 7.4
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: production
Advisory age: 1570d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-r64q-w8jr-g9qp for urllib3
Medium
Update certifi to fix a medium vulnerability(GHSA-43fp)
Fix: 2022.12.077.2/10
Certifi removing TrustCor root certificate certifi is declared as ">=2023.5.7" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.7). Reported via GHSA-43fp-rhv2-5gv8 (GHSA).
Upgrade certifi to 2022.12.07 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.7) + 0.40 × ecosystem value (9.4) = 7.2
Impact inputs
CVSS: 5.7
Severity: medium
Dependency type: production
Advisory age: 1361d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-43fp-rhv2-5gv8 for certifi
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2026)
Fix: 1.26.196.6/10
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 4.8). Reported via PYSEC-2026-1995 (OSV).
Upgrade urllib3 to 1.26.19 or later — trivial effort (patch version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.8) + 0.40 × ecosystem value (9.4) = 6.6
Impact inputs
CVSS: 4.8
Severity: medium
Dependency type: production
Advisory age: 53d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-1995 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-34jh)
Fix: 1.26.196.6/10
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 4.8). Reported via GHSA-34jh-p97f-mpxf (GHSA).
Upgrade urllib3 to 1.26.19 or later — trivial effort (patch version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.8) + 0.40 × ecosystem value (9.4) = 6.6
Impact inputs
CVSS: 4.8
Severity: medium
Dependency type: production
Advisory age: 803d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-34jh-p97f-mpxf for urllib3
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2026)
Fix: 2.5.06.9/10
urllib3 does not control redirects in browsers and Node.js urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via PYSEC-2026-1997 (OSV).
Upgrade urllib3 to 2.5.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 53d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-1997 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2026)
Fix: 2.5.06.9/10
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via PYSEC-2026-1999 (OSV).
Upgrade urllib3 to 2.5.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 53d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-1999 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2026)
Fix: 2.7.06.9/10
Advisory PYSEC-2026-141 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via PYSEC-2026-141 (OSV).
Upgrade urllib3 to 2.7.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 108d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-141 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-qccp)
Fix: 2.7.06.9/10
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-qccp-gfcp-xxvc (GHSA).
Upgrade urllib3 to 2.7.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 110d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-qccp-gfcp-xxvc for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-48p4)
Fix: 2.5.06.9/10
urllib3 does not control redirects in browsers and Node.js urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-48p4-8xcf-vxj5 (GHSA).
Upgrade urllib3 to 2.5.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 437d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-48p4-8xcf-vxj5 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-pq67)
Fix: 2.5.06.9/10
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-pq67-6m6q-mj2v (GHSA).
Upgrade urllib3 to 2.5.0 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 437d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-pq67-6m6q-mj2v for urllib3
Medium
Update urllib3 to fix a medium vulnerability(GHSA-g4mx)
Fix: 2.0.76.5/10
urllib3's request body not stripped after redirect from 303 status changes request method to GET urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 4.5). Reported via GHSA-g4mx-q9vg-27p4 (GHSA).
Upgrade urllib3 to 2.0.7 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.5) + 0.40 × ecosystem value (9.4) = 6.5
Impact inputs
CVSS: 4.5
Severity: medium
Dependency type: production
Advisory age: 1047d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-g4mx-q9vg-27p4 for urllib3
Medium
Update urllib3 to fix a medium vulnerability(PYSEC-2023)
Fix: 2.0.76.5/10
Advisory PYSEC-2023-212 urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 4.5). Reported via PYSEC-2023-212 (OSV).
Upgrade urllib3 to 2.0.7 or later — medium effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.5) + 0.40 × ecosystem value (9.4) = 6.5
Impact inputs
CVSS: 4.5
Severity: medium
Dependency type: production
Advisory age: 1047d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: available
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2023-212 for urllib3
Medium
Update idna to fix a medium vulnerability(PYSEC-2026)
Fix: 3.156.9/10
Advisory PYSEC-2026-215 idna is declared as ">=2.5,<4" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via PYSEC-2026-215 (OSV).
Upgrade idna to 3.15 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 85d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
OSV advisory PYSEC-2026-215 for idna
Medium
Update idna to fix a medium vulnerability(GHSA-65pc)
Fix: 3.156.9/10
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix idna is declared as ">=2.5,<4" and used as a production PyPI dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-65pc-fj4g-8rjx (GHSA).
Upgrade idna to 3.15 or later — high effort (major version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.3) + 0.40 × ecosystem value (9.4) = 6.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: production
Advisory age: 102d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-65pc-fj4g-8rjx for idna
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-x527)
Fix: 0.52.06.0/10
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 10.0). Reported via GHSA-x527-x647-q7gg (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (10.0) + 0.40 × ecosystem value (0.0) = 6.0
Impact inputs
CVSS: 10.0
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x527-x647-q7gg for golang.org/x/crypto
Low
Update urllib3 to fix a low vulnerability(GHSA-v4w5)
Fix: 1.18.16.0/10
Urllib3 Incorrect Certificate Validation urllib3 is declared as ">=1.26,<3" and used as a production PyPI dependency of this repo. Severity: low (CVSS 3.7). Reported via GHSA-v4w5-p2hg-8fh6 (GHSA).
Upgrade urllib3 to 1.18.1 or later — low effort (minor version bump).
Medium confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.7) + 0.40 × ecosystem value (9.4) = 6.0
Impact inputs
CVSS: 3.7
Severity: low
Dependency type: production
Advisory age: 1566d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
Source
GHSA advisory GHSA-v4w5-p2hg-8fh6 for urllib3
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-5cgq)
Fix: 0.52.05.5/10
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-5cgq-3rg8-m6cv (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-5cgq-3rg8-m6cv for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-rm3j)
Fix: 0.52.05.5/10
golang.org/x/crypto vulnerable to infinite loop on large channel writes golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-rm3j-f69w-wqmq (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-rm3j-f69w-wqmq for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-89gr)
Fix: 0.52.05.5/10
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-89gr-r52h-f8rx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-89gr-r52h-f8rx for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-vgwf)
Fix: 0.52.05.5/10
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-vgwf-h737-ff37 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vgwf-h737-ff37 for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-f5wc)
Fix: 0.52.05.5/10
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-f5wc-c3c7-36mc (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f5wc-c3c7-36mc for golang.org/x/crypto
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-jppx)
Fix: 0.52.05.5/10
golang.org/x/crypto doesn't enforce invoking key constraints golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-jppx-rxg9-jmrx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jppx-rxg9-jmrx for golang.org/x/crypto
Critical
Update @tauri-apps/plugin-shell to fix a critical vulnerability(GHSA-c9pr)
Fix: 2.2.15.6/10
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` @tauri-apps/plugin-shell is declared as "^2.3.5" and used as a production npm dependency of this repo. Severity: critical. Reported via GHSA-c9pr-q8gx-3mgp (GHSA).
Upgrade @tauri-apps/plugin-shell to 2.2.1 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
Claimed by @SpIob
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.5) = 5.6
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 519d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c9pr-q8gx-3mgp for @tauri-apps/plugin-shell
Critical
Update golang.org/x/crypto to fix a critical vulnerability(GHSA-v778)
Fix: 0.31.05.5/10
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: critical (CVSS 9.1). Reported via GHSA-v778-237x-gjrc (GHSA).
Upgrade golang.org/x/crypto to 0.31.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.1) + 0.40 × ecosystem value (0.0) = 5.5
Impact inputs
CVSS: 9.1
Severity: critical
Dependency type: production
Advisory age: 631d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v778-237x-gjrc for golang.org/x/crypto
High
Update xterm to fix a high vulnerability(GHSA-mc23)
Fix: 3.8.15.5/10
xterm vulnerable to remote code execution xterm is declared as "^5.3.0" and used as a production npm dependency of this repo. Severity: high (CVSS 8.8). Reported via GHSA-mc23-976p-j42x (GHSA).
Upgrade xterm to 3.8.1 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (8.8) + 0.40 × ecosystem value (0.5) = 5.5
Impact inputs
CVSS: 8.8
Severity: high
Dependency type: production
Advisory age: 2789d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-mc23-976p-j42x for xterm
Low
Update certifi to fix a low vulnerability(GHSA-248v)
Fix: 2024.7.45.3/10
Certifi removes GLOBALTRUST root certificate certifi is declared as ">=2023.5.7" and used as a production PyPI dependency of this repo. Severity: low. Reported via GHSA-248v-346w-9cwc (GHSA).
Upgrade certifi to 2024.7.4 or later — high effort (major version bump).
⚠ Low confidencepsf/requests
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.5) + 0.40 × ecosystem value (9.4) = 5.3
Impact inputs
CVSS: unknown
Severity: low
Dependency type: production
Advisory age: 785d
Ecosystem value inputs
Repo stars: 54,266
Open issues: 234
Downstream dependents: 112,450
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
Source
GHSA advisory GHSA-248v-346w-9cwc for certifi
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-w879)
Fix: 0.52.04.5/10
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-w879-237q-wc7r (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-w879-237q-wc7r for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-q4h4)
Fix: 0.52.04.5/10
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-q4h4-gmj2-qvw2 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 70d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-q4h4-gmj2-qvw2 for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-hcg3)
Fix: 0.35.04.5/10
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-hcg3-q754-cr77 (GHSA).
Upgrade golang.org/x/crypto to 0.35.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.5) + 0.40 × ecosystem value (0.0) = 4.5
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: production
Advisory age: 510d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hcg3-q754-cr77 for golang.org/x/crypto
High
Update golang.org/x/crypto to fix a high vulnerability(GHSA-xhjq)
Fix: 0.0.0-20170330155735-e4e2799dd7aa4.9/10
golang.org/x/crypto/ssh Man-in-the-Middle attack golang.org/x/crypto is declared as "v0.29.0" and used as a production Go dependency of this repo. Severity: high (CVSS 8.1). Reported via GHSA-xhjq-w7xm-p8qj (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later — low effort (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (8.1) + 0.40 × ecosystem value (0.0) = 4.9
Impact inputs
CVSS: 8.1
Severity: high
Dependency type: production
Advisory age: 1304d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xhjq-w7xm-p8qj for golang.org/x/crypto

Missions

Update urllib3 to fix a critical vulnerability(GHSA-www2)

Update urllib3 to fix a high vulnerability(PYSEC-2023)

Update urllib3 to fix a high vulnerability(GHSA-q2q7)

Update certifi to fix a high vulnerability(GHSA-xqr8)

Update urllib3 to fix a high vulnerability(GHSA-hmv2)

Update urllib3 to fix a high vulnerability(GHSA-mh33)

Update urllib3 to fix a high vulnerability(PYSEC-2026)

Update urllib3 to fix a high vulnerability(PYSEC-2026)

Update urllib3 to fix a high vulnerability(GHSA-mf9v)

Update urllib3 to fix a high vulnerability(GHSA-38jv)

Update urllib3 to fix a high vulnerability(GHSA-2xpw)

Update urllib3 to fix a high vulnerability(GHSA-gm62)

Update idna to fix a high vulnerability(PYSEC-2024)

Update certifi to fix a high vulnerability(PYSEC-2024)

Update urllib3 to fix a medium vulnerability(GHSA-5phf)

Update urllib3 to fix a medium vulnerability(GHSA-wqvq)

Update urllib3 to fix a medium vulnerability(GHSA-v845)

Update idna to fix a medium vulnerability(GHSA-jjg7)

Update urllib3 to fix a medium vulnerability(GHSA-gwvm)

Update urllib3 to fix a medium vulnerability(PYSEC-2023)

Update urllib3 to fix a medium vulnerability(GHSA-r64q)

Update certifi to fix a medium vulnerability(GHSA-43fp)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(GHSA-34jh)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(GHSA-qccp)

Update urllib3 to fix a medium vulnerability(GHSA-48p4)

Update urllib3 to fix a medium vulnerability(GHSA-pq67)

Update urllib3 to fix a medium vulnerability(GHSA-g4mx)

Update urllib3 to fix a medium vulnerability(PYSEC-2023)

Update idna to fix a medium vulnerability(PYSEC-2026)

Update idna to fix a medium vulnerability(GHSA-65pc)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-x527)

Update urllib3 to fix a low vulnerability(GHSA-v4w5)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-5cgq)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-rm3j)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-89gr)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-vgwf)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-f5wc)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-jppx)

Update @tauri-apps/plugin-shell to fix a critical vulnerability(GHSA-c9pr)

Update golang.org/x/crypto to fix a critical vulnerability(GHSA-v778)

Update xterm to fix a high vulnerability(GHSA-mc23)

Update certifi to fix a low vulnerability(GHSA-248v)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-w879)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-q4h4)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-hcg3)

Update golang.org/x/crypto to fix a high vulnerability(GHSA-xhjq)

Missions

Update urllib3 to fix a critical vulnerability(GHSA-www2)

Update urllib3 to fix a high vulnerability(PYSEC-2023)

Update urllib3 to fix a high vulnerability(GHSA-q2q7)

Update certifi to fix a high vulnerability(GHSA-xqr8)

Update urllib3 to fix a high vulnerability(GHSA-hmv2)

Update urllib3 to fix a high vulnerability(GHSA-mh33)

Update urllib3 to fix a high vulnerability(PYSEC-2026)

Update urllib3 to fix a high vulnerability(PYSEC-2026)

Update urllib3 to fix a high vulnerability(GHSA-mf9v)

Update urllib3 to fix a high vulnerability(GHSA-38jv)

Update urllib3 to fix a high vulnerability(GHSA-2xpw)

Update urllib3 to fix a high vulnerability(GHSA-gm62)

Update idna to fix a high vulnerability(PYSEC-2024)

Update certifi to fix a high vulnerability(PYSEC-2024)

Update urllib3 to fix a medium vulnerability(GHSA-5phf)

Update urllib3 to fix a medium vulnerability(GHSA-wqvq)

Update urllib3 to fix a medium vulnerability(GHSA-v845)

Update idna to fix a medium vulnerability(GHSA-jjg7)

Update urllib3 to fix a medium vulnerability(GHSA-gwvm)

Update urllib3 to fix a medium vulnerability(PYSEC-2023)

Update urllib3 to fix a medium vulnerability(GHSA-r64q)

Update certifi to fix a medium vulnerability(GHSA-43fp)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(GHSA-34jh)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(PYSEC-2026)

Update urllib3 to fix a medium vulnerability(GHSA-qccp)