Skip to content
Tools / GoCD / Security

Security Deep Dive

GoCD

Security posture and CVE patch evidence from tracked releases.

Back to Tool

2 actively-exploited dependency CVEs affects 25.4.0.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

— Signed — SLSA ✓ SBOM ✓ Security policy Unknown cadence Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Present
GitHub SBOM API Latest release
Last verified: 1mo ago
SECURITY.md Present
GitHub repository metadata Repository policy
Checked: 27d ago
Release cadence Unknown
12-release median Release history
Latest release: 5mo ago
Maintainer active Present
Recent commit activity Repository
Last commit: 5d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 5mo ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 5mo ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 5mo ago
3.3/10 Security Score
3.9/10 Scorecard
Dependency Exposure 42 transitive dependency CVEs found in the latest SBOM. 9 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

2d stale

scorecard

1.56 / 4.0

Score 3.9/10

cve health

0.00 / 2.5

⚠ No direct scan — 9c/17h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 9c/17h

Provenance trust

provenance trust

3.9

40%

scorecard score: 3.9 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 2d

Operational risk

operational risk

8.5

10%

kev exposure: detected epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
9 Transitive critical CVEs
2 KEV-transitive CVEs
80% Dependency freshness

Scorecard

Scorecard 3.9/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check Score Reason
Packaging -1 packaging workflow not detected
Maintained 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review 0 Found 0/10 approved changesets -- score normalized to 0
CII-Best-Practices 0 no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow -1 no workflows found
Token-Permissions -1 No tokens found
Security-Policy 10 security policy file detected
License 10 license file detected
Signed-Releases -1 no releases found
Branch-Protection -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies 0 dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts 5 binaries present in source code
SAST 0 SAST tool is not run on all commits -- score normalized to 0
Fuzzing 0 project is not fuzzed

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

1314 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

9

High

17

Medium

13

Low

3

Unknown

0

2 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (42) All (42)
Critical 9 High 17 Medium 13 Low 3
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2016-1000027 critical — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2021-42392 critical — com.h2database:h2 1.4.200 —
CVE-2022-22965 critical KEV org.springframework:spring-beans 4.3.30.RELEASE —
CVE-2022-22965 critical KEV org.springframework:spring-webmvc 4.3.30.RELEASE —
CVE-2022-22978 critical — org.springframework.security:spring-security-core 4.2.20.RELEASE —
CVE-2022-22978 critical — org.springframework.security:spring-security-web 4.2.20.RELEASE —
CVE-2022-23221 critical — com.h2database:h2 1.4.200 —
CVE-2024-38821 critical — org.springframework.security:spring-security-web 4.2.20.RELEASE —
CVE-2026-22732 critical — org.springframework.security:spring-security-web 4.2.20.RELEASE —
CVE-2020-25638 high — org.hibernate:hibernate-core 3.6.10.Final —
CVE-2021-22112 high — org.springframework.security:spring-security-web 4.2.20.RELEASE —
CVE-2021-23463 high — com.h2database:h2 1.4.200 —
CVE-2022-22968 high — org.springframework:spring-context 4.3.30.RELEASE —
CVE-2022-22970 high — org.springframework:spring-beans 4.3.30.RELEASE —
CVE-2022-45868 high — com.h2database:h2 1.4.200 —
CVE-2023-20863 high — org.springframework:spring-expression 4.3.30.RELEASE —
CVE-2024-22243 high — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2024-22257 high — org.springframework.security:spring-security-core 4.2.20.RELEASE —
CVE-2024-22259 high — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2024-22262 high — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2024-38819 high — org.springframework:spring-webmvc 4.3.30.RELEASE —
CVE-2026-2332 high — org.eclipse.jetty:jetty-http 10.0.26 —
CVE-2026-44728 high — @babel/plugin-transform-modules-systemjs 7.29.0 —
CVE-2026-6321 high — fast-uri 3.1.0 —
CVE-2026-6322 high — fast-uri 3.1.0 —
GHSA-c4rq-3m3g-8wgx high — nokogiri 1.18.10 —
CVE-2019-14900 medium — org.hibernate:hibernate-core 3.6.10.Final —
CVE-2022-22950 medium — org.springframework:spring-expression 4.3.30.RELEASE —
CVE-2023-20861 medium — org.springframework:spring-expression 4.3.30.RELEASE —
CVE-2024-38808 medium — org.springframework:spring-expression 4.3.30.RELEASE —
CVE-2024-38809 medium — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2024-38820 medium — org.springframework:spring-context 4.3.30.RELEASE —
CVE-2024-38820 medium — org.springframework:spring-web 4.3.30.RELEASE —
CVE-2024-38827 medium — org.springframework.security:spring-security-core 4.2.20.RELEASE —
CVE-2024-6763 medium — org.eclipse.jetty:jetty-http 10.0.26 —
CVE-2025-4949 medium — org.eclipse.jgit:org.eclipse.jgit 6.7.0.202309050840-r —
CVE-2026-22745 medium — org.springframework:spring-webmvc 4.3.30.RELEASE —
GHSA-v2fc-qm4h-8hqv medium — nokogiri 1.18.10 —
GHSA-wx95-c6cv-8532 medium — nokogiri 1.18.10 —
CVE-2025-11143 low — org.eclipse.jetty:jetty-http 10.0.26 —
CVE-2025-22233 low — org.springframework:spring-context 4.3.30.RELEASE —
CVE-2026-22741 low — org.springframework:spring-webmvc 4.3.30.RELEASE —

Showing 42 of 42

Beta — feedback welcome: [email protected]