Tools / Mailu / Security

Security Deep Dive

Mailu

Security posture and CVE patch evidence from tracked releases.

Back to Tool

10 high-severity dependency CVEs affects 2024.06.52.

Review the dependency vulnerabilities below.

— Signed — SLSA — SBOM ✓ Security policy Monthly cadence · 19d median Active maintainer

Trust Signals — 3 of 9 Present

Evidence already collected from releases and repository metadata.

3/9 Present

Signed releases Unknown

Latest release artifact signature Latest release

—

SLSA provenance Unknown

Attestation predicate level Latest release

—

SBOM published Unknown

GitHub SBOM API Latest release

—

SECURITY.md Present

GitHub repository metadata Repository policy

Checked: 22d ago

Release cadence: monthly Present

19d median over recent releases Release history

Latest release: 6d ago

Maintainer active Present

Recent commit activity Repository

Last commit: 3d ago

Checksums (SHA256SUMS) Not active yet

SHA256SUMS or equivalent Release asset

Latest release: 6d ago

GitHub Actions attestation Not active yet

actions/attest-build-provenance Workflow file

Latest release: 6d ago

Signing assets Not active yet

.sig, .crt, cosign.pub, or similar Release asset

Latest release: 6d ago

4.0/10 Security Score

5.5/10 Scorecard

Dependency Exposure 56 transitive dependency CVEs found in the latest SBOM.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

2d stale

scorecard

2.20 / 4.0

Score 5.5/10

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 10c/35h

Provenance trust

provenance trust

5.5

40%

scorecard score: 5.5 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 2d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none

How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100

0 Transitive critical CVEs

0 KEV-transitive CVEs

64% Dependency freshness

Scorecard

Scorecard 5.5/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check	Score	Reason
Maintained	10	23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	10	all changesets reviewed
Security-Policy	3	security policy file detected
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
License	9	license file detected
Packaging	-1	packaging workflow not detected
Branch-Protection	-1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Dangerous-Workflow	10	no dangerous workflow patterns detected
Signed-Releases	-1	no releases found
Fuzzing	0	project is not fuzzed
Binary-Artifacts	9	binaries present in source code
Token-Permissions	0	detected GitHub workflow tokens with excessive permissions
SAST	0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	0	dependency not pinned by hash detected -- score normalized to 0

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

158 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

High

Medium

Low

Unknown

Still affecting latest (56) All (123)

High 10 Medium 29 Low 17

CVE	Severity	KEV	Dependency	Affected version	Cleared in release
CVE-2024-21272	high	—	mysql-connector-python	8.4.0	2024.06.51
CVE-2024-6345	high	—	setuptools	69.5.1	2024.06.51
CVE-2025-47273	high	—	setuptools	69.5.1	2024.06.51
CVE-2025-66418	high	—	urllib3	2.2.1	2024.06.51
CVE-2025-66471	high	—	urllib3	2.2.1	2024.06.51
CVE-2025-69223	high	—	aiohttp	3.9.5	2024.06.51
CVE-2026-21441	high	—	urllib3	2.2.1	2024.06.51
CVE-2026-24049	high	—	wheel	0.43.0	2024.06.51
CVE-2026-26007	high	—	cryptography	42.0.6	2024.06.51
CVE-2026-44307	high	—	mako	1.3.3	2024.06.51
CVE-2024-35195	medium	—	requests	2.31.0	2024.06.51
CVE-2024-37891	medium	—	urllib3	2.2.1	2024.06.51
CVE-2024-47081	medium	—	requests	2.31.0	2024.06.51
CVE-2024-49766	medium	—	werkzeug	3.0.3	2024.06.51
CVE-2024-49767	medium	—	werkzeug	3.0.3	2024.06.51
CVE-2024-52304	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2024-56201	medium	—	jinja2	3.1.4	2024.06.51
CVE-2024-56326	medium	—	jinja2	3.1.4	2024.06.51
CVE-2025-27516	medium	—	jinja2	3.1.4	2024.06.51
CVE-2025-48945	medium	—	pycares	4.4.0	2024.06.51
CVE-2025-50181	medium	—	urllib3	2.2.1	2024.06.51
CVE-2025-50182	medium	—	urllib3	2.2.1	2024.06.51
CVE-2025-66221	medium	—	werkzeug	3.0.3	2024.06.51
CVE-2025-68480	medium	—	marshmallow	3.21.2	2024.06.51
CVE-2025-69227	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69228	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69229	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2025-8869	medium	—	pip	24.0	2024.06.51
CVE-2026-21860	medium	—	werkzeug	3.0.3	2024.06.51
CVE-2026-22815	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2026-25645	medium	—	requests	2.31.0	2024.06.51
CVE-2026-27199	medium	—	werkzeug	3.0.3	2024.06.51
CVE-2026-3219	medium	—	pip	24.0	2024.06.51
CVE-2026-34515	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34516	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34525	medium	—	aiohttp	3.9.5	2024.06.51
CVE-2026-41205	medium	—	mako	1.3.3	2024.06.51
CVE-2026-6357	medium	—	pip	24.0	2024.06.51
GHSA-h4gh-qq45-vh27	medium	—	cryptography	42.0.6	2024.06.51
CVE-2024-12797	low	—	cryptography	42.0.6	2024.06.51
CVE-2024-39689	low	—	certifi	2024.2.2	2024.06.51
CVE-2025-53643	low	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69224	low	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69225	low	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69226	low	—	aiohttp	3.9.5	2024.06.51
CVE-2025-69230	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-1703	low	—	pip	24.0	2024.06.51
CVE-2026-27205	low	—	flask	3.0.3	2024.06.51
CVE-2026-34073	low	—	cryptography	42.0.6	2024.06.51
CVE-2026-34513	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34514	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34517	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34518	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34519	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-34520	low	—	aiohttp	3.9.5	2024.06.51
CVE-2026-4539	low	—	pygments	2.18.0	2024.06.51

Showing 56 of 123