Skip to content
Tools / freescout / Security

Security Deep Dive

freescout

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects 1.8.223.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

20 versions tracked
Version Published C H M L KEV Notes
1.8.223 2026-05-30
Latest
1.8.222 2026-05-25
1.8.221 2026-05-23
1.8.220 2026-05-17
1.8.219 2026-05-08
Patches CVE-2018-15133
1.8.218 2026-04-25 1 KEV 1
1.8.217 2026-04-19 1 KEV 1
1.8.216 2026-04-16 1 KEV 1
1.8.215 2026-04-14 1 KEV 1
1.8.214 2026-04-12 1 KEV 1
1.8.213 2026-04-12 1 KEV 1
1.8.212 2026-04-04 1 KEV 1
1.8.211 2026-03-28 1 KEV 1
1.8.210 2026-03-23 1 KEV 1
1.8.209 2026-03-14 1 KEV 1
1.8.208 2026-03-06 1 KEV 1
1.8.207 2026-02-27 1 KEV 1
1.8.206 2026-02-21 1 KEV 1
1.8.205 2026-02-14 1 KEV 1
1.8.204 2026-02-08 1 KEV 1
— Signed — SLSA — SBOM ✓ Security policy Weekly cadence · 5d median Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
SLSA provenance Unknown
Attestation predicate level Latest release
SBOM published Unknown
GitHub SBOM API Latest release
SECURITY.md Present
GitHub repository metadata Repository policy
Checked: 23d ago
Release cadence: weekly Present
5d median over recent releases Release history
Latest release: 4d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 1d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 4d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 4d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 4d ago
0.5/10 Security Score
Dependency Exposure 28 transitive dependency CVEs found in the latest SBOM. 3 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.844

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 51.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

4.9

10%

supply chain risk: 51.0 transitive cves: 3c/12h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.844
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 51.0/100
3 Transitive critical CVEs
1 KEV-transitive CVEs
100% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2018-15133 HIGH 99%ile 1.8.219 KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

112 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

3

High

12

Medium

12

Low

1

Unknown

0

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Critical 3 High 12 Medium 12 Low 1
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2019-10913 critical symfony/http-foundation 3.4.18 1.8.219
CVE-2023-35169 critical webklex/php-imap 4.1.1 1.8.219
GHSA-qm5c-m76r-2hfr critical laravel/framework 5.5.40 1.8.219
CVE-2018-15133 high KEV laravel/framework 5.5.40 1.8.220
CVE-2019-18887 high symfony/http-kernel 3.4.18 1.8.219
CVE-2019-18888 high symfony/http-foundation 3.4.18 1.8.219
CVE-2020-19316 high laravel/framework 5.5.40 1.8.219
CVE-2020-24941 high laravel/framework 5.5.40 1.8.219
CVE-2024-51736 high symfony/process 3.4.18 1.8.219
CVE-2024-52301 high laravel/framework 5.5.40 1.8.219
CVE-2025-64500 high symfony/http-foundation 3.4.18 1.8.219
CVE-2026-24765 high phpunit/phpunit 9.5.28 1.8.219
GHSA-4mg9-vhxq-vm7j high laravel/framework 5.5.40 1.8.219
GHSA-6jvx-8ch9-j2jr high laravel/framework 5.5.40 1.8.219
GHSA-x7p5-p2c9-phvg high laravel/framework 5.5.40 1.8.219
CVE-2019-11358 medium maximebf/debugbar 1.15.1 1.8.219
CVE-2020-11022 medium maximebf/debugbar 1.15.1 1.8.219
CVE-2021-43808 medium laravel/framework 5.5.40 1.8.219
CVE-2022-24894 medium symfony/http-kernel 3.4.18 1.8.219
CVE-2024-28859 medium swiftmailer/swiftmailer 6.1.3 1.8.219
CVE-2025-22145 medium nesbot/carbon 1.35.1 1.8.219
CVE-2025-27515 medium laravel/framework 5.5.40 1.8.219
CVE-2025-49130 medium barryvdh/laravel-translation-manager 0.5.0 1.8.219
CVE-2026-24739 medium symfony/process 3.4.18 1.8.219
CVE-2026-25129 medium psy/psysh 0.9.12 1.8.219
GHSA-3fvf-2gp4-89wq medium barryvdh/laravel-translation-manager 0.5.0 1.8.219
GHSA-44pg-c29v-hp6r medium laravel/framework 5.5.40 1.8.219
CVE-2024-50345 low symfony/http-foundation 3.4.18 1.8.219

Showing 28 of 28

Beta — feedback welcome: [email protected]