Skip to content
Tools / Checkov / Security

Security Deep Dive

Checkov

Security posture and CVE patch evidence from tracked releases.

Back to Tool

2 actively-exploited dependency CVEs affects 3.2.532.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

20 versions tracked
Version Published C H M L KEV Notes
3.2.532 2026-06-02 — — — — —
Latest
3.2.531 2026-06-01 — — — — —
—
3.2.530 2026-05-28 — — — — —
—
3.2.529 2026-05-14 — — — — —
—
3.2.528 2026-05-10 — — — — —
—
3.2.527 2026-05-07 — — — — —
Patches CVE-2020-11023 Patches CVE-2023-44487
3.2.526 2026-04-30 — 1 1 — KEV 2
—
3.2.525 2026-04-26 — 1 1 — KEV 2
—
3.2.524 2026-04-20 — 1 1 — KEV 2
—
3.2.522 2026-04-19 — 1 1 — KEV 2
—
3.2.521 2026-04-14 — 1 1 — KEV 2
—
3.2.519 2026-04-12 — 1 1 — KEV 2
—
3.2.517 2026-04-06 — 1 1 — KEV 2
—
3.2.513 2026-03-27 — 1 1 — KEV 2
—
3.2.511 2026-03-26 — 1 1 — KEV 2
—
3.2.510 2026-03-18 — 1 1 — KEV 2
—
3.2.508 2026-03-08 — 1 1 — KEV 2
—
3.2.507 2026-03-05 — 1 1 — KEV 2
—
3.2.506 2026-02-23 — 1 1 — KEV 2
—
3.2.505 2026-02-22 — 1 1 — KEV 2
—
— Signed — SLSA — SBOM ✓ Security policy Weekly cadence · 4d median Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Present
GitHub repository metadata Repository policy
Checked: 23d ago
Release cadence: weekly Present
4d median over recent releases Release history
Latest release: 1d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 1d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 1d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 1d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 1d ago
1.3/10 Security Score
7.0/10 Scorecard
Dependency Exposure 124 transitive dependency CVEs found in the latest SBOM. 10 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.944

freshness

1.00 / 1.0

1d stale

scorecard

2.80 / 4.0

Score 7.0/10

cve health

0.00 / 2.5

⚠ No direct scan — 14c/58h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 14c/58h

Provenance trust

provenance trust

7.0

40%

scorecard score: 7.0 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.944
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
10 Transitive critical CVEs
2 KEV-transitive CVEs
80% Dependency freshness

Scorecard

Scorecard 7.0/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check Score Reason
Maintained 10 30 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review 3 11 out of last 30 changesets reviewed before merge -- score normalized to 3
Vulnerabilities 10 no vulnerabilities detected
CII-Best-Practices 2 badge detected: in_progress
Signed-Releases -1 no releases found
Branch-Protection 6 branch protection is not maximal on development and all release branches
Token-Permissions 0 non read-only tokens detected in GitHub workflows
Security-Policy 10 security policy file detected
License 10 license file detected
Dependency-Update-Tool 10 update tool detected
Dangerous-Workflow 10 no dangerous workflow patterns detected
Fuzzing 0 project is not fuzzed
SAST 10 SAST tool is run on all commits
Binary-Artifacts 10 no binaries found in the repo
Packaging 10 publishing workflow detected
Pinned-Dependencies 0 dependency not pinned by hash detected -- score normalized to 0

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
2
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2020-11023 MEDIUM 97%ile — 3.2.527 — — KEV
CVE-2023-44487 HIGH 99%ile — 3.2.527 — — KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

315 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

10

High

51

Medium

45

Low

7

Unknown

11

2 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (124) All (182)
Critical 10 High 51 Medium 45 Low 7 Unknown 11
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2011-0698 critical — django 1.2 3.2.527
CVE-2012-3442 critical — django 1.2 3.2.527
CVE-2014-0472 critical — django 1.2 3.2.527
CVE-2018-1285 critical — log4net 2.0.9 3.2.527
CVE-2019-10744 critical — lodash 3.1.0 3.2.527
CVE-2019-19844 critical — django 1.2 3.2.527
CVE-2020-7471 critical — django 1.2 3.2.527
CVE-2024-45337 critical — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2025-64459 critical — django 1.2 3.2.527
CVE-2026-33186 critical — google.golang.org/grpc 1.22.0 3.2.527
CVE-2010-4534 high — django 1.2 3.2.527
CVE-2011-0696 high — django 1.2 3.2.527
CVE-2011-4137 high — django 1.2 3.2.527
CVE-2011-4138 high — django 1.2 3.2.527
CVE-2011-4139 high — django 1.2 3.2.527
CVE-2011-4140 high — django 1.2 3.2.527
CVE-2012-3443 high — django 1.2 3.2.527
CVE-2012-3444 high — django 1.2 3.2.527
CVE-2014-0473 high — django 1.2 3.2.527
CVE-2014-0474 high — django 1.2 3.2.527
CVE-2014-0480 high — django 1.2 3.2.527
CVE-2014-0481 high — django 1.2 3.2.527
CVE-2014-10064 high — qs 0.5.1 3.2.527
CVE-2014-7191 high — qs 0.5.1 3.2.527
CVE-2015-0221 high — django 1.2 3.2.527
CVE-2015-5143 high — django 1.2 3.2.527
CVE-2015-5144 high — django 1.2 3.2.527
CVE-2016-7401 high — django 1.2 3.2.527
CVE-2017-1000048 high — qs 0.5.1 3.2.527
CVE-2017-16119 high — fresh 0.1.0 3.2.527
CVE-2017-16138 high — mime 1.2.6 3.2.527
CVE-2018-1000656 high — flask 0.6 3.2.527
CVE-2018-16487 high — lodash 3.1.0 3.2.527
CVE-2019-1010083 high — flask 0.6 3.2.527
CVE-2020-26160 high — github.com/dgrijalva/jwt-go 3.2.0+incompatible 3.2.527
CVE-2020-29652 high — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2021-23337 high — lodash 3.1.0 3.2.527
CVE-2021-33194 high — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2021-42248 high — github.com/tidwall/gjson 1.7.4 3.2.527
CVE-2021-43565 high — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2022-21698 high — github.com/prometheus/client_golang 1.0.0 3.2.527
CVE-2022-24999 high — qs 0.5.1 3.2.527
CVE-2022-27191 high — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2022-27664 high — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2022-36359 high — django 1.2 3.2.527
CVE-2022-41723 high — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2023-30861 high — flask 0.6 3.2.527
CVE-2023-39325 high — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2025-22868 high — golang.org/x/oauth2 0.0.0-20190604053449-0f29369cfe45 3.2.527
CVE-2025-22869 high — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2025-57833 high — django 1.2 3.2.527
CVE-2025-64458 high — django 1.2 3.2.527
CVE-2025-65637 high — github.com/sirupsen/logrus 1.4.2 3.2.527
CVE-2025-66418 high — urllib3 1.26.20 3.2.527
CVE-2025-66471 high — urllib3 1.26.20 3.2.527
CVE-2026-21441 high — urllib3 1.26.20 3.2.527
CVE-2026-42215 high — gitpython 3.1.46 3.2.527
CVE-2026-42284 high — gitpython 3.1.46 3.2.527
CVE-2026-44243 high — gitpython 3.1.46 3.2.527
CVE-2026-44244 high — gitpython 3.1.46 3.2.527
GHSA-m425-mq94-257g high — google.golang.org/grpc 1.22.0 3.2.527
CVE-2010-3082 medium — django 1.2 3.2.527
CVE-2010-4535 medium — django 1.2 3.2.527
CVE-2011-0697 medium — django 1.2 3.2.527
CVE-2011-4136 medium — django 1.2 3.2.527
CVE-2013-7371 medium — connect 2.6.0 3.2.527
CVE-2014-0482 medium — django 1.2 3.2.527
CVE-2014-0483 medium — django 1.2 3.2.527
CVE-2014-6393 medium — express 3.0.0 3.2.527
CVE-2015-0219 medium — django 1.2 3.2.527
CVE-2015-0220 medium — django 1.2 3.2.527
CVE-2015-2241 medium — django 1.2 3.2.527
CVE-2015-2317 medium — django 1.2 3.2.527
CVE-2015-8859 medium — send 0.1.0 3.2.527
CVE-2016-2512 medium — django 1.2 3.2.527
CVE-2016-6186 medium — django 1.2 3.2.527
CVE-2018-3717 medium — connect 2.6.0 3.2.527
CVE-2018-3721 medium — lodash 3.1.0 3.2.527
CVE-2019-11358 medium — jQuery 3.0.0 3.2.527
CVE-2020-11023 medium KEV jQuery 3.0.0 3.2.528
CVE-2020-8559 medium — k8s.io/apimachinery 0.18.6 3.2.527
CVE-2021-31525 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2021-33203 medium — django 1.2 3.2.527
CVE-2022-29526 medium — golang.org/x/sys 0.0.0-20210415045647-66c3f260301c 3.2.527
CVE-2022-41717 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2023-32681 medium — requests 2.26.0 3.2.527
CVE-2023-3978 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2023-44487 medium KEV golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.528
CVE-2023-45288 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2023-48795 medium — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2024-10491 medium — express 3.0.0 3.2.527
CVE-2024-28180 medium — gopkg.in/square/go-jose.v2 2.3.1 3.2.527
CVE-2024-29041 medium — express 3.0.0 3.2.527
CVE-2024-35195 medium — requests 2.26.0 3.2.527
CVE-2024-45231 medium — django 1.2 3.2.527
CVE-2024-47081 medium — requests 2.26.0 3.2.527
CVE-2025-15284 medium — qs 0.5.1 3.2.527
CVE-2025-22870 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2025-22872 medium — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2025-47914 medium — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2025-48432 medium — django 1.2 3.2.527
CVE-2025-50181 medium — urllib3 1.26.20 3.2.527
CVE-2025-58181 medium — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2026-25645 medium — requests 2.32.5 3.2.527
CVE-2026-2950 medium — lodash 3.1.0 3.2.527
CVE-2026-40021 medium — log4net 2.0.9 3.2.527
CVE-2013-7370 low — connect 2.6.0 3.2.527
CVE-2014-6394 low — send 0.1.0 3.2.527
CVE-2016-2513 low — django 1.2 3.2.527
CVE-2024-43796 low — express 3.0.0 3.2.527
CVE-2024-43799 low — send 0.1.0 3.2.527
CVE-2024-47764 low — cookie 0.0.4 3.2.527
CVE-2026-27205 low — flask 0.6 3.2.527
CVE-2015-0222 unknown — django 1.2 3.2.527
CVE-2015-8213 unknown — django 1.2 3.2.527
CVE-2016-9014 unknown — django 1.2 3.2.527
CVE-2021-44716 unknown — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2022-30636 unknown — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2024-45338 unknown — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2025-47911 unknown — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2025-47913 unknown — golang.org/x/crypto 0.0.0-20200622213623-75b288015ac9 3.2.527
CVE-2025-58190 unknown — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
CVE-2026-33814 unknown — golang.org/x/net 0.0.0-20210415231046-e915ea6b2b7d 3.2.527
GO-2023-2153 unknown — google.golang.org/grpc 1.22.0 3.2.527

Showing 124 of 182

Beta — feedback welcome: [email protected]