Skip to content
Tools / bugsink / Security

Security Deep Dive

bugsink

Security posture and CVE patch evidence from tracked releases.

Back to Tool

17 critical dependency CVEs affects 2.2.1.

Audit transitive dependencies; consider upgrading or pinning replacements.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

13 versions tracked
Version Published C H M L KEV Notes
2.2.1 2026-05-22 — — — — —
Latest
2.2.0 2026-05-21 — — — — —
—
2.1.3 2026-05-02 — — — — —
—
2.1.2 2026-04-11 — — — — —
—
2.1.1 2026-04-09 — — — — —
Patches GHSA-8hw4-fhww-273g
2.1.0 2026-04-04 — 1 — — —
—
2.0.14 2026-03-03 — 1 — — —
—
2.0.13 2026-02-21 — 1 — — —
Patches GHSA-vp6q-7m36-pq3w
2.0.12 2026-01-26 1 1 — — —
—
2.0.11 2026-01-20 1 1 — — —
—
2.0.9 2026-01-13 1 1 — — —
—
2.0.8 2026-01-10 1 1 — — —
—
2.0.7 2026-01-10 1 1 — — —
—
— Signed — SLSA — SBOM ✓ Security policy Weekly cadence · 6d median Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Present
GitHub repository metadata Repository policy
Checked: 22d ago
Release cadence: weekly Present
6d median over recent releases Release history
Latest release: 12d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 1d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 12d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 12d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 12d ago
3.8/10 Security Score
0d avg CVE Patch Speed
Dependency Exposure 175 transitive dependency CVEs found in the latest SBOM. 17 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

0d avg

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: 0

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 17c/76h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
17 Transitive critical CVEs
0 KEV-transitive CVEs
59% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Median patch time: 0 days

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
2
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
GHSA-8hw4-fhww-273g High — — 2.1.1 — — —
GHSA-vp6q-7m36-pq3w Critical — — 2.0.13 — — —

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

151 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

17

High

76

Medium

70

Low

12

Unknown

0

Still affecting latest (0) All (175)
Critical 17 High 76 Medium 70 Low 12
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2011-0698 critical — django — 2.2.0
CVE-2012-3442 critical — django — 2.2.0
CVE-2014-0472 critical — django — 2.2.0
CVE-2014-1418 critical — django — 2.2.0
CVE-2015-8557 critical — pygments — 2.2.0
CVE-2016-9013 critical — django — 2.2.0
CVE-2016-9014 critical — django — 2.2.0
CVE-2019-14234 critical — django — 2.2.0
CVE-2019-19844 critical — django — 2.2.0
CVE-2020-7471 critical — django — 2.2.0
CVE-2021-35042 critical — django — 2.2.0
CVE-2022-28346 critical — django — 2.2.0
CVE-2022-28347 critical — django — 2.2.0
CVE-2022-34265 critical — django — 2.2.0
CVE-2023-31047 critical — django — 2.2.0
CVE-2024-42005 critical — django — 2.2.0
CVE-2025-64459 critical — django — 2.2.0
CVE-2007-0404 high — django — 2.2.0
CVE-2007-5712 high — django — 2.2.0
CVE-2008-3909 high — django — 2.2.0
CVE-2009-2659 high — django — 2.2.0
CVE-2009-3695 high — django — 2.2.0
CVE-2010-4534 high — django — 2.2.0
CVE-2011-0696 high — django — 2.2.0
CVE-2011-4137 high — django — 2.2.0
CVE-2011-4138 high — django — 2.2.0
CVE-2011-4139 high — django — 2.2.0
CVE-2011-4140 high — django — 2.2.0
CVE-2012-3443 high — django — 2.2.0
CVE-2012-3444 high — django — 2.2.0
CVE-2012-4520 high — django — 2.2.0
CVE-2013-1443 high — django — 2.2.0
CVE-2013-1633 high — setuptools — 2.2.0
CVE-2013-4315 high — django — 2.2.0
CVE-2014-0473 high — django — 2.2.0
CVE-2014-0474 high — django — 2.2.0
CVE-2014-0480 high — django — 2.2.0
CVE-2014-0481 high — django — 2.2.0
CVE-2014-3730 high — django — 2.2.0
CVE-2015-0221 high — django — 2.2.0
CVE-2015-0222 high — django — 2.2.0
CVE-2015-2316 high — django — 2.2.0
CVE-2015-5143 high — django — 2.2.0
CVE-2015-5144 high — django — 2.2.0
CVE-2015-5145 high — django — 2.2.0
CVE-2016-2048 high — django — 2.2.0
CVE-2016-7401 high — django — 2.2.0
CVE-2018-1000164 high — gunicorn — 2.2.0
CVE-2018-18074 high — requests — 2.2.0
CVE-2018-6188 high — django — 2.2.0
CVE-2019-14232 high — django — 2.2.0
CVE-2019-14233 high — django — 2.2.0
CVE-2019-14235 high — django — 2.2.0
CVE-2019-19118 high — django — 2.2.0
CVE-2019-3498 high — django — 2.2.0
CVE-2019-6975 high — django — 2.2.0
CVE-2020-13254 high — django — 2.2.0
CVE-2020-24583 high — django — 2.2.0
CVE-2020-9402 high — django — 2.2.0
CVE-2021-20270 high — pygments — 2.2.0
CVE-2021-27291 high — pygments — 2.2.0
CVE-2021-31542 high — django — 2.2.0
CVE-2021-33571 high — django — 2.2.0
CVE-2021-45115 high — django — 2.2.0
CVE-2021-45116 high — django — 2.2.0
CVE-2022-23833 high — django — 2.2.0
CVE-2022-36359 high — django — 2.2.0
CVE-2022-40897 high — setuptools — 2.2.0
CVE-2022-41323 high — django — 2.2.0
CVE-2023-23969 high — django — 2.2.0
CVE-2023-24580 high — django — 2.2.0
CVE-2023-28117 high — sentry-sdk — 2.2.0
CVE-2023-36053 high — django — 2.2.0
CVE-2023-43665 high — django — 2.2.0
CVE-2023-46695 high — django — 2.2.0
CVE-2024-1135 high — gunicorn — 2.2.0
CVE-2024-24680 high — django — 2.2.0
CVE-2024-38875 high — django — 2.2.0
CVE-2024-39330 high — django — 2.2.0
CVE-2024-39614 high — django — 2.2.0
CVE-2024-53908 high — django — 2.2.0
CVE-2024-6345 high — setuptools — 2.2.0
CVE-2024-6827 high — gunicorn — 2.2.0
CVE-2025-47273 high — setuptools — 2.2.0
CVE-2025-57833 high — django — 2.2.0
CVE-2025-59681 high — django — 2.2.0
CVE-2025-6176 high — brotli — 2.2.0
CVE-2025-64458 high — django — 2.2.0
CVE-2026-1207 high — django — 2.2.0
CVE-2026-1287 high — django — 2.2.0
CVE-2026-25673 high — django — 2.2.0
CVE-2026-33034 high — django — 2.2.0
CVE-2026-3902 high — django — 2.2.0
CVE-2007-0405 medium — django — 2.2.0
CVE-2008-2302 medium — django — 2.2.0
CVE-2010-3082 medium — django — 2.2.0
CVE-2010-4535 medium — django — 2.2.0
CVE-2011-0697 medium — django — 2.2.0
CVE-2011-4136 medium — django — 2.2.0
CVE-2013-0305 medium — django — 2.2.0
CVE-2013-0306 medium — django — 2.2.0
CVE-2013-1664 medium — django — 2.2.0
CVE-2013-1665 medium — django — 2.2.0
CVE-2013-4249 medium — django — 2.2.0
CVE-2013-6044 medium — django — 2.2.0
CVE-2014-0482 medium — django — 2.2.0
CVE-2014-0483 medium — django — 2.2.0
CVE-2014-1829 medium — requests — 2.2.0
CVE-2014-1830 medium — requests — 2.2.0
CVE-2015-0219 medium — django — 2.2.0
CVE-2015-0220 medium — django — 2.2.0
CVE-2015-2241 medium — django — 2.2.0
CVE-2015-2296 medium — requests — 2.2.0
CVE-2015-2317 medium — django — 2.2.0
CVE-2015-3982 medium — django — 2.2.0
CVE-2015-5963 medium — django — 2.2.0
CVE-2015-5964 medium — django — 2.2.0
CVE-2015-8213 medium — django — 2.2.0
CVE-2016-2512 medium — django — 2.2.0
CVE-2016-6186 medium — django — 2.2.0
CVE-2017-12794 medium — django — 2.2.0
CVE-2017-7233 medium — django — 2.2.0
CVE-2017-7234 medium — django — 2.2.0
CVE-2018-14574 medium — django — 2.2.0
CVE-2018-16984 medium — django — 2.2.0
CVE-2018-7536 medium — django — 2.2.0
CVE-2019-11358 medium — django — 2.2.0
CVE-2019-12308 medium — django — 2.2.0
CVE-2019-12781 medium — django — 2.2.0
CVE-2020-13596 medium — django — 2.2.0
CVE-2020-24584 medium — django — 2.2.0
CVE-2020-25626 medium — djangorestframework — 2.2.0
CVE-2020-36846 medium — brotli — 2.2.0
CVE-2021-28658 medium — django — 2.2.0
CVE-2021-32052 medium — django — 2.2.0
CVE-2021-3281 medium — django — 2.2.0
CVE-2021-33203 medium — django — 2.2.0
CVE-2021-44420 medium — django — 2.2.0
CVE-2021-45452 medium — django — 2.2.0
CVE-2022-22818 medium — django — 2.2.0
CVE-2022-40896 medium — pygments — 2.2.0
CVE-2023-32681 medium — requests — 2.2.0
CVE-2023-41164 medium — django — 2.2.0
CVE-2024-27351 medium — django — 2.2.0
CVE-2024-35195 medium — requests — 2.2.0
CVE-2024-39329 medium — django — 2.2.0
CVE-2024-41989 medium — django — 2.2.0
CVE-2024-41990 medium — django — 2.2.0
CVE-2024-41991 medium — django — 2.2.0
CVE-2024-45230 medium — django — 2.2.0
CVE-2024-45231 medium — django — 2.2.0
CVE-2024-47081 medium — requests — 2.2.0
CVE-2024-53907 medium — django — 2.2.0
CVE-2024-56374 medium — django — 2.2.0
CVE-2025-13372 medium — django — 2.2.0
CVE-2025-26699 medium — django — 2.2.0
CVE-2025-27556 medium — django — 2.2.0
CVE-2025-32873 medium — django — 2.2.0
CVE-2025-48432 medium — django — 2.2.0
CVE-2025-64460 medium — django — 2.2.0
CVE-2026-1312 medium — django — 2.2.0
CVE-2026-25645 medium — requests — 2.2.0
CVE-2026-33033 medium — django — 2.2.0
CVE-2016-2513 low — django — 2.2.0
CVE-2018-7537 low — django — 2.2.0
CVE-2024-21520 low — djangorestframework — 2.2.0
CVE-2024-40647 low — sentry-sdk — 2.2.0
CVE-2025-13473 low — django — 2.2.0
CVE-2025-14550 low — django — 2.2.0
CVE-2025-59682 low — django — 2.2.0
CVE-2026-1285 low — django — 2.2.0
CVE-2026-25674 low — django — 2.2.0
CVE-2026-4277 low — django — 2.2.0
CVE-2026-4292 low — django — 2.2.0
CVE-2026-4539 low — pygments — 2.2.0

Showing 175 of 175

Beta — feedback welcome: [email protected]