Security Deep Dive
calibre-web
Security posture and CVE patch evidence from tracked releases.
11 critical dependency CVEs affects 0.6.26.
Audit transitive dependencies; consider upgrading or pinning replacements.
Trust Signals — 3 of 9 Present
Evidence already collected from releases and repository metadata.
Security Score
A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.
epss
0.25 / 0.5
No EPSS data
freshness
1.00 / 1.0
10d stale
scorecard
1.84 / 4.0
Score 4.6/10
cve health
0.00 / 2.5
Open CVEs detected
patch speed
0.50 / 0.5
⚠ Estimated — no CVE patch history
kev exposure
1.50 / 1.5
No KEV exposure
supply chain risk
-1.50 / 10.0
Risk 100.0/100
Score breakdown
schema v2Vulnerability posture
vulnerability posture
0.0
25%
Release responsiveness
release responsiveness
10.0
5%
Dependency exposure
dependency exposure
0.0
10%
Provenance trust
provenance trust
4.6
40%
Maintainer health
maintainer health
10.0
10%
Operational risk
operational risk
8.5
10%
How is this calculated?
The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.
Supply Chain Risk
Risk 100.0/100Scorecard
Scorecard 4.6/10OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.
| Check | Score | Reason |
|---|---|---|
| Packaging | -1 | packaging workflow not detected |
| Token-Permissions | -1 | No tokens found |
| Code-Review | 5 | Found 11/19 approved changesets -- score normalized to 5 |
| Dangerous-Workflow | -1 | no workflows found |
| Security-Policy | 10 | security policy file detected |
| Maintained | 10 | 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Binary-Artifacts | 10 | no binaries found in the repo |
| Pinned-Dependencies | -1 | no dependencies found |
| License | 10 | license file detected |
| Signed-Releases | 0 | Project has not signed or included provenance with any releases. |
| Branch-Protection | 0 | branch protection not enabled on development/release branches |
| Fuzzing | 0 | project is not fuzzed |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
OpenSSF Badge
Badge indicates adherence to open-source best practices.
Dependency Vulnerabilities
Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.
Critical
11
High
40
Medium
69
Low
12
Unknown
0
| CVE | Severity | KEV | Dependency | Affected version | Cleared in release |
|---|---|---|---|---|---|
| CVE-2012-0805 | critical | — | sqlalchemy | — | — |
| CVE-2017-18342 | critical | — | pyyaml | — | — |
| CVE-2018-20060 | critical | — | urllib3 | — | — |
| CVE-2018-7753 | critical | — | bleach | — | — |
| CVE-2019-20477 | critical | — | pyyaml | — | — |
| CVE-2019-7164 | critical | — | sqlalchemy | — | — |
| CVE-2019-7548 | critical | — | sqlalchemy | — | — |
| CVE-2020-14343 | critical | — | pyyaml | — | — |
| CVE-2020-1747 | critical | — | pyyaml | — | — |
| CVE-2022-44900 | critical | — | py7zr | — | — |
| CVE-2023-41419 | critical | — | gevent | — | — |
| CVE-2012-2374 | high | — | tornado | — | — |
| CVE-2013-1633 | high | — | setuptools | — | — |
| CVE-2014-9720 | high | — | tornado | — | — |
| CVE-2016-9243 | high | — | cryptography | — | — |
| CVE-2018-1000656 | high | — | flask | — | — |
| CVE-2018-10903 | high | — | cryptography | — | — |
| CVE-2018-18074 | high | — | requests | — | — |
| CVE-2019-1010083 | high | — | flask | — | — |
| CVE-2019-11324 | high | — | urllib3 | — | — |
| CVE-2020-13757 | high | — | rsa | — | — |
| CVE-2020-25658 | high | — | rsa | — | — |
| CVE-2020-25659 | high | — | cryptography | — | — |
| CVE-2020-36242 | high | — | cryptography | — | — |
| CVE-2020-6817 | high | — | bleach | — | — |
| CVE-2020-7212 | high | — | urllib3 | — | — |
| CVE-2021-21240 | high | — | httplib2 | — | — |
| CVE-2021-26813 | high | — | markdown2 | — | — |
| CVE-2021-33503 | high | — | urllib3 | — | — |
| CVE-2021-42771 | high | — | babel | — | — |
| CVE-2022-40897 | high | — | setuptools | — | — |
| CVE-2023-0286 | high | — | cryptography | — | — |
| CVE-2023-30861 | high | — | flask | — | — |
| CVE-2023-37920 | high | — | certifi | — | — |
| CVE-2023-38325 | high | — | cryptography | — | — |
| CVE-2023-43804 | high | — | urllib3 | — | — |
| CVE-2023-50782 | high | — | cryptography | — | — |
| CVE-2024-26130 | high | — | cryptography | — | — |
| CVE-2024-52804 | high | — | tornado | — | — |
| CVE-2024-6345 | high | — | setuptools | — | — |
| CVE-2025-47273 | high | — | setuptools | — | — |
| CVE-2025-47287 | high | — | tornado | — | — |
| CVE-2025-66418 | high | — | urllib3 | — | — |
| CVE-2025-66471 | high | — | urllib3 | — | — |
| CVE-2026-21441 | high | — | urllib3 | — | — |
| CVE-2026-23490 | high | — | pyasn1 | — | — |
| CVE-2026-26007 | high | — | cryptography | — | — |
| CVE-2026-30922 | high | — | pyasn1 | — | — |
| CVE-2026-31958 | high | — | tornado | — | — |
| CVE-2026-35536 | high | — | tornado | — | — |
| CVE-2026-41066 | high | — | lxml | — | — |
| CVE-2009-3724 | medium | — | markdown2 | — | — |
| CVE-2013-2037 | medium | — | httplib2 | — | — |
| CVE-2014-1829 | medium | — | requests | — | — |
| CVE-2014-1830 | medium | — | requests | — | — |
| CVE-2014-3146 | medium | — | lxml | — | — |
| CVE-2015-2296 | medium | — | requests | — | — |
| CVE-2016-1494 | medium | — | rsa | — | — |
| CVE-2016-9015 | medium | — | urllib3 | — | — |
| CVE-2018-19787 | medium | — | lxml | — | — |
| CVE-2018-25091 | medium | — | urllib3 | — | — |
| CVE-2018-5773 | medium | — | markdown2 | — | — |
| CVE-2019-11236 | medium | — | urllib3 | — | — |
| CVE-2020-11078 | medium | — | httplib2 | — | — |
| CVE-2020-11888 | medium | — | markdown2 | — | — |
| CVE-2020-26137 | medium | — | urllib3 | — | — |
| CVE-2020-27783 | medium | — | lxml | — | — |
| CVE-2020-6802 | medium | — | bleach | — | — |
| CVE-2020-6816 | medium | — | bleach | — | — |
| CVE-2021-23980 | medium | — | bleach | — | — |
| CVE-2021-28363 | medium | — | urllib3 | — | — |
| CVE-2021-28957 | medium | — | lxml | — | — |
| CVE-2021-43818 | medium | — | lxml | — | — |
| CVE-2021-46823 | medium | — | python-ldap | — | — |
| CVE-2022-2309 | medium | — | lxml | — | — |
| CVE-2022-23491 | medium | — | certifi | — | — |
| CVE-2023-23931 | medium | — | cryptography | — | — |
| CVE-2023-28370 | medium | — | tornado | — | — |
| CVE-2023-32681 | medium | — | requests | — | — |
| CVE-2023-36464 | medium | — | pypdf | — | — |
| CVE-2023-45803 | medium | — | urllib3 | — | — |
| CVE-2023-46250 | medium | — | pypdf | — | — |
| CVE-2023-49083 | medium | — | cryptography | — | — |
| CVE-2024-0727 | medium | — | cryptography | — | — |
| CVE-2024-35195 | medium | — | requests | — | — |
| CVE-2024-37891 | medium | — | urllib3 | — | — |
| CVE-2024-47081 | medium | — | requests | — | — |
| CVE-2025-50181 | medium | — | urllib3 | — | — |
| CVE-2025-50182 | medium | — | urllib3 | — | — |
| CVE-2025-55197 | medium | — | pypdf | — | — |
| CVE-2025-61911 | medium | — | python-ldap | — | — |
| CVE-2025-61912 | medium | — | python-ldap | — | — |
| CVE-2025-62707 | medium | — | pypdf | — | — |
| CVE-2025-62708 | medium | — | pypdf | — | — |
| CVE-2025-66019 | medium | — | pypdf | — | — |
| CVE-2026-24688 | medium | — | pypdf | — | — |
| CVE-2026-25645 | medium | — | requests | — | — |
| CVE-2026-27024 | medium | — | pypdf | — | — |
| CVE-2026-27025 | medium | — | pypdf | — | — |
| CVE-2026-27026 | medium | — | pypdf | — | — |
| CVE-2026-27888 | medium | — | pypdf | — | — |
| CVE-2026-28351 | medium | — | pypdf | — | — |
| CVE-2026-28804 | medium | — | pypdf | — | — |
| CVE-2026-31826 | medium | — | pypdf | — | — |
| CVE-2026-33123 | medium | — | pypdf | — | — |
| CVE-2026-33699 | medium | — | pypdf | — | — |
| CVE-2026-34531 | medium | — | flask-httpauth | — | — |
| CVE-2026-39892 | medium | — | cryptography | — | — |
| CVE-2026-40260 | medium | — | pypdf | — | — |
| CVE-2026-41168 | medium | — | pypdf | — | — |
| CVE-2026-41312 | medium | — | pypdf | — | — |
| CVE-2026-41313 | medium | — | pypdf | — | — |
| CVE-2026-41314 | medium | — | pypdf | — | — |
| GHSA-39hc-v87j-747x | medium | — | cryptography | — | — |
| GHSA-753j-mpmx-qq6g | medium | — | tornado | — | — |
| GHSA-78cv-mqj4-43f7 | medium | — | tornado | — | — |
| GHSA-h4gh-qq45-vh27 | medium | — | cryptography | — | — |
| GHSA-qppv-j76h-2rpx | medium | — | tornado | — | — |
| GHSA-r8wq-qrxc-hmcm | medium | — | python-ldap | — | — |
| GHSA-w235-7p84-xx57 | medium | — | tornado | — | — |
| CVE-2023-49297 | low | — | pydrive2 | — | — |
| CVE-2024-12797 | low | — | cryptography | — | — |
| CVE-2024-39689 | low | — | certifi | — | — |
| CVE-2025-47278 | low | — | flask | — | — |
| CVE-2026-22690 | low | — | pypdf | — | — |
| CVE-2026-22691 | low | — | pypdf | — | — |
| CVE-2026-27205 | low | — | flask | — | — |
| CVE-2026-27628 | low | — | pypdf | — | — |
| CVE-2026-34073 | low | — | cryptography | — | — |
| GHSA-5cpq-8wj7-hf2v | low | — | cryptography | — | — |
| GHSA-jm77-qphf-c4w8 | low | — | cryptography | — | — |
| GHSA-v8gr-m533-ghj9 | low | — | cryptography | — | — |
Showing 132 of 132