Skip to content
Tools / Ralph / Security

Security Deep Dive

Ralph

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects 20260609.1.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

9 versions tracked
Version Published C H M L KEV Notes
20260609.1 2026-06-09 — — — — —
Latest Patches CVE-2023-4863
20260506.1 2026-05-06 — 1 — — KEV 1
—
20260327.1 2026-03-27 — 1 — — KEV 1
—
20260324.1 2026-03-24 — 1 — — KEV 1
—
20260309.1 2026-03-09 — 1 — — KEV 1
—
20260129.1 2026-01-29 — 1 — — KEV 1
—
20260126.1 2026-01-26 — 1 — — KEV 1
—
20260123.1 2026-01-23 — 1 — — KEV 1
—
20260122.1 2026-01-22 — 1 — — KEV 1
—
— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 9d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 13d ago
Release cadence: weekly Present
9d median over recent releases Release history
Latest release: 1mo ago
Maintainer active Present
Recent commit activity Repository
Last commit: 23d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 1mo ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 1mo ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 1mo ago
0.7/10 Security Score
5.6/10 Scorecard
Dependency Exposure 257 transitive dependency CVEs found in the latest SBOM. 28 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.997

freshness

1.00 / 1.0

16d stale

scorecard

2.24 / 4.0

Score 5.6/10

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 28c/119h

Provenance trust

provenance trust

5.6

40%

scorecard score: 5.6 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 16d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.997
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
28 Transitive critical CVEs
1 KEV-transitive CVEs
74% Dependency freshness

Scorecard

Scorecard 5.6/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check Score Reason
Maintained 10 22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review 6 Found 8/13 approved changesets -- score normalized to 6
Packaging -1 packaging workflow not detected
Dangerous-Workflow 10 no dangerous workflow patterns detected
Token-Permissions 0 detected GitHub workflow tokens with excessive permissions
CII-Best-Practices 0 no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts 10 no binaries found in the repo
Security-Policy 0 security policy file not detected
License 10 license file detected
Fuzzing 0 project is not fuzzed
Signed-Releases -1 no releases found
Branch-Protection -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST 9 SAST tool is not run on all commits -- score normalized to 9
Pinned-Dependencies 0 dependency not pinned by hash detected -- score normalized to 0

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2023-4863 HIGH 99%ile — 20260609.1 — — KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

231 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

28

High

119

Medium

89

Low

17

Unknown

4

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (56) All (257)
Critical 28 High 119 Medium 89 Low 17 Unknown 4
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2011-0698 critical — django — 20260609.1
CVE-2012-3442 critical — django — 20260609.1
CVE-2013-2166 critical — python-keystoneclient — 20260609.1
CVE-2013-2167 critical — python-keystoneclient — 20260609.1
CVE-2014-0472 critical — django — 20260609.1
CVE-2014-1418 critical — django — 20260609.1
CVE-2014-3007 critical — pillow — 20260609.1
CVE-2016-4009 critical — pillow — 20260609.1
CVE-2016-9013 critical — django — 20260609.1
CVE-2016-9014 critical — django — 20260609.1
CVE-2019-14234 critical — django — 20260609.1
CVE-2019-19844 critical — django — 20260609.1
CVE-2020-11538 critical — pillow — 20260609.1
CVE-2020-5310 critical — pillow — 20260609.1
CVE-2020-5311 critical — pillow — 20260609.1
CVE-2020-5312 critical — pillow — 20260609.1
CVE-2020-7471 critical — django — 20260609.1
CVE-2021-25289 critical — pillow — 20260609.1
CVE-2021-34552 critical — pillow — 20260609.1
CVE-2021-35042 critical — django — 20260609.1
CVE-2022-22817 critical — pillow — 20260609.1
CVE-2022-28346 critical — django — 20260609.1
CVE-2022-28347 critical — django — 20260609.1
CVE-2022-34265 critical — django — 20260609.1
CVE-2023-31047 critical — django — 20260609.1
CVE-2023-50447 critical — pillow — 20260609.1
CVE-2024-42005 critical — django — 20260609.1
CVE-2025-64459 critical — django 4.2.23 20260609.1
CVE-2007-0404 high — django — 20260609.1
CVE-2007-5712 high — django — 20260609.1
CVE-2008-3909 high — django — 20260609.1
CVE-2009-2659 high — django — 20260609.1
CVE-2009-3695 high — django — 20260609.1
CVE-2010-4534 high — django — 20260609.1
CVE-2011-0696 high — django — 20260609.1
CVE-2011-4137 high — django — 20260609.1
CVE-2011-4138 high — django — 20260609.1
CVE-2011-4139 high — django — 20260609.1
CVE-2011-4140 high — django — 20260609.1
CVE-2012-3443 high — django — 20260609.1
CVE-2012-3444 high — django — 20260609.1
CVE-2012-4520 high — django — 20260609.1
CVE-2013-1443 high — django — 20260609.1
CVE-2013-2104 high — python-keystoneclient — 20260609.1
CVE-2013-4315 high — django — 20260609.1
CVE-2014-0473 high — django — 20260609.1
CVE-2014-0474 high — django — 20260609.1
CVE-2014-0480 high — django — 20260609.1
CVE-2014-0481 high — django — 20260609.1
CVE-2014-1932 high — pillow — 20260609.1
CVE-2014-3589 high — pillow — 20260609.1
CVE-2014-3598 high — pillow — 20260609.1
CVE-2014-3730 high — django — 20260609.1
CVE-2014-7144 high — python-keystoneclient — 20260609.1
CVE-2014-9601 high — pillow — 20260609.1
CVE-2015-0221 high — django — 20260609.1
CVE-2015-0222 high — django — 20260609.1
CVE-2015-1852 high — python-keystoneclient — 20260609.1
CVE-2015-2316 high — django — 20260609.1
CVE-2015-5143 high — django — 20260609.1
CVE-2015-5144 high — django — 20260609.1
CVE-2015-5145 high — django — 20260609.1
CVE-2016-0775 high — pillow — 20260609.1
CVE-2016-2048 high — django — 20260609.1
CVE-2016-2533 high — pillow — 20260609.1
CVE-2016-3076 high — pillow — 20260609.1
CVE-2016-7401 high — django — 20260609.1
CVE-2016-9190 high — pillow — 20260609.1
CVE-2018-6188 high — django — 20260609.1
CVE-2019-14232 high — django — 20260609.1
CVE-2019-14233 high — django — 20260609.1
CVE-2019-14235 high — django — 20260609.1
CVE-2019-16865 high — pillow — 20260609.1
CVE-2019-19118 high — django — 20260609.1
CVE-2019-19911 high — pillow — 20260609.1
CVE-2019-3498 high — django — 20260609.1
CVE-2019-6975 high — django — 20260609.1
CVE-2020-10177 high — pillow — 20260609.1
CVE-2020-10378 high — pillow — 20260609.1
CVE-2020-10379 high — pillow — 20260609.1
CVE-2020-10994 high — pillow — 20260609.1
CVE-2020-13254 high — django — 20260609.1
CVE-2020-24583 high — django — 20260609.1
CVE-2020-35653 high — pillow — 20260609.1
CVE-2020-35654 high — pillow — 20260609.1
CVE-2020-5313 high — pillow — 20260609.1
CVE-2020-9402 high — django — 20260609.1
CVE-2021-23437 high — pillow — 20260609.1
CVE-2021-25287 high — pillow — 20260609.1
CVE-2021-25288 high — pillow — 20260609.1
CVE-2021-25290 high — pillow — 20260609.1
CVE-2021-25291 high — pillow — 20260609.1
CVE-2021-25293 high — pillow — 20260609.1
CVE-2021-27921 high — pillow — 20260609.1
CVE-2021-27922 high — pillow — 20260609.1
CVE-2021-27923 high — pillow — 20260609.1
CVE-2021-28675 high — pillow — 20260609.1
CVE-2021-28676 high — pillow — 20260609.1
CVE-2021-28677 high — pillow — 20260609.1
CVE-2021-31542 high — django — 20260609.1
CVE-2021-33571 high — django — 20260609.1
CVE-2021-45115 high — django — 20260609.1
CVE-2021-45116 high — django — 20260609.1
CVE-2022-23833 high — django — 20260609.1
CVE-2022-24303 high — pillow — 20260609.1
CVE-2022-30595 high — pillow — 20260609.1
CVE-2022-36359 high — django — 20260609.1
CVE-2022-41323 high — django — 20260609.1
CVE-2022-45198 high — pillow — 20260609.1
CVE-2022-45199 high — pillow — 20260609.1
CVE-2023-23969 high — django — 20260609.1
CVE-2023-24580 high — django — 20260609.1
CVE-2023-25577 high — werkzeug 0.16.1 20260609.1
CVE-2023-28859 high — redis — 20260609.1
CVE-2023-36053 high — django — 20260609.1
CVE-2023-43665 high — django — 20260609.1
CVE-2023-44271 high — pillow — 20260609.1
CVE-2023-46695 high — django — 20260609.1
CVE-2023-4863 high KEV pillow — —
CVE-2024-24680 high — django — 20260609.1
CVE-2024-28219 high — pillow — 20260609.1
CVE-2024-34069 high — werkzeug 0.16.1 20260609.1
CVE-2024-38875 high — django — 20260609.1
CVE-2024-39330 high — django — 20260609.1
CVE-2024-39614 high — django — 20260609.1
CVE-2024-53908 high — django — 20260609.1
CVE-2024-6345 high — setuptools 65.7.0 20260609.1
CVE-2025-47273 high — setuptools 65.7.0 20260609.1
CVE-2025-48379 high — pillow — 20260609.1
CVE-2025-57833 high — django 4.2.23 20260609.1
CVE-2025-59681 high — django 4.2.23 20260609.1
CVE-2025-64458 high — django 4.2.23 20260609.1
CVE-2025-66418 high — urllib3 2.5.0 20260609.1
CVE-2025-66471 high — urllib3 2.5.0 20260609.1
CVE-2026-1207 high — django 4.2.23 20260609.1
CVE-2026-1287 high — django 4.2.23 20260609.1
CVE-2026-21441 high — urllib3 2.5.0 20260609.1
CVE-2026-23490 high — pyasn1 0.6.1 20260609.1
CVE-2026-25673 high — django 4.2.23 20260609.1
CVE-2026-25990 high — pillow 11.3.0 20260609.1
CVE-2026-26007 high — cryptography 45.0.5 20260609.1
CVE-2026-30922 high — pyasn1 0.6.1 20260609.1
CVE-2026-32597 high — pyjwt 2.10.1 20260609.1
CVE-2026-33034 high — django 4.2.23 20260609.1
CVE-2026-3902 high — django 4.2.23 20260609.1
CVE-2026-40192 high — pillow 11.3.0 20260609.1
CVE-2026-42311 high — pillow 11.3.0 20260609.1
CVE-2007-0405 medium — django — 20260609.1
CVE-2008-2302 medium — django — 20260609.1
CVE-2010-3082 medium — django — 20260609.1
CVE-2010-4535 medium — django — 20260609.1
CVE-2011-0697 medium — django — 20260609.1
CVE-2011-4136 medium — django — 20260609.1
CVE-2013-0305 medium — django — 20260609.1
CVE-2013-0306 medium — django — 20260609.1
CVE-2013-1664 medium — django — 20260609.1
CVE-2013-1665 medium — django — 20260609.1
CVE-2013-2030 medium — python-keystoneclient — 20260609.1
CVE-2013-2255 medium — python-keystoneclient — 20260609.1
CVE-2013-4249 medium — django — 20260609.1
CVE-2013-6044 medium — django — 20260609.1
CVE-2014-0482 medium — django — 20260609.1
CVE-2014-0483 medium — django — 20260609.1
CVE-2014-1933 medium — pillow — 20260609.1
CVE-2015-0219 medium — django — 20260609.1
CVE-2015-0220 medium — django — 20260609.1
CVE-2015-2241 medium — django — 20260609.1
CVE-2015-2317 medium — django — 20260609.1
CVE-2015-3982 medium — django — 20260609.1
CVE-2015-5963 medium — django — 20260609.1
CVE-2015-5964 medium — django — 20260609.1
CVE-2015-8213 medium — django — 20260609.1
CVE-2016-0740 medium — pillow — 20260609.1
CVE-2016-2512 medium — django — 20260609.1
CVE-2016-6186 medium — django — 20260609.1
CVE-2016-9189 medium — pillow — 20260609.1
CVE-2017-12794 medium — django — 20260609.1
CVE-2017-5992 medium — openpyxl — 20260609.1
CVE-2017-7233 medium — django — 20260609.1
CVE-2017-7234 medium — django — 20260609.1
CVE-2018-14574 medium — django — 20260609.1
CVE-2018-16984 medium — django — 20260609.1
CVE-2018-7536 medium — django — 20260609.1
CVE-2019-11358 medium — django — 20260609.1
CVE-2019-12308 medium — django — 20260609.1
CVE-2019-12781 medium — django — 20260609.1
CVE-2020-13596 medium — django — 20260609.1
CVE-2020-24584 medium — django — 20260609.1
CVE-2020-35655 medium — pillow — 20260609.1
CVE-2021-25292 medium — pillow — 20260609.1
CVE-2021-28658 medium — django — 20260609.1
CVE-2021-28678 medium — pillow — 20260609.1
CVE-2021-32052 medium — django — 20260609.1
CVE-2021-3281 medium — django — 20260609.1
CVE-2021-33203 medium — django — 20260609.1
CVE-2021-44420 medium — django — 20260609.1
CVE-2021-45452 medium — django — 20260609.1
CVE-2022-22815 medium — pillow — 20260609.1
CVE-2022-22816 medium — pillow — 20260609.1
CVE-2022-22818 medium — django — 20260609.1
CVE-2023-28858 medium — redis — 20260609.1
CVE-2023-41164 medium — django — 20260609.1
CVE-2023-46136 medium — werkzeug 0.16.1 20260609.1
CVE-2024-27351 medium — django — 20260609.1
CVE-2024-39329 medium — django — 20260609.1
CVE-2024-41989 medium — django — 20260609.1
CVE-2024-41990 medium — django — 20260609.1
CVE-2024-41991 medium — django — 20260609.1
CVE-2024-45230 medium — django — 20260609.1
CVE-2024-45231 medium — django — 20260609.1
CVE-2024-49766 medium — werkzeug 0.16.1 20260609.1
CVE-2024-49767 medium — werkzeug 0.16.1 20260609.1
CVE-2024-53907 medium — django — 20260609.1
CVE-2024-56374 medium — django — 20260609.1
CVE-2025-13372 medium — django 4.2.23 20260609.1
CVE-2025-26699 medium — django — 20260609.1
CVE-2025-27556 medium — django — 20260609.1
CVE-2025-32873 medium — django — 20260609.1
CVE-2025-48432 medium — django — 20260609.1
CVE-2025-61783 medium — social-auth-app-django 5.4.3 20260609.1
CVE-2025-61911 medium — python-ldap 3.4.4 20260609.1
CVE-2025-61912 medium — python-ldap 3.4.4 20260609.1
CVE-2025-64460 medium — django 4.2.23 20260609.1
CVE-2025-66221 medium — werkzeug 0.16.1 20260609.1
CVE-2025-69534 medium — markdown 3.2.1 20260609.1
CVE-2026-1312 medium — django 4.2.23 20260609.1
CVE-2026-21860 medium — werkzeug 0.16.1 20260609.1
CVE-2026-25645 medium — requests 2.32.4 20260609.1
CVE-2026-27199 medium — werkzeug 0.16.1 20260609.1
CVE-2026-33033 medium — django 4.2.23 20260609.1
CVE-2026-39892 medium — cryptography 45.0.5 20260609.1
CVE-2026-42308 medium — pillow 11.3.0 20260609.1
CVE-2026-42309 medium — pillow 11.3.0 20260609.1
CVE-2026-42310 medium — pillow 11.3.0 20260609.1
GHSA-27jp-wm6q-gp25 medium — sqlparse 0.5.3 20260609.1
GHSA-jgpv-4h4c-xhw3 medium — pillow — 20260609.1
CVE-2013-2013 low — python-keystoneclient — 20260609.1
CVE-2014-0105 low — python-keystoneclient — 20260609.1
CVE-2016-2513 low — django — 20260609.1
CVE-2018-7537 low — django — 20260609.1
CVE-2023-23934 low — werkzeug 0.16.1 20260609.1
CVE-2024-21520 low — djangorestframework 3.15.0 20260609.1
CVE-2025-13473 low — django 4.2.23 20260609.1
CVE-2025-14550 low — django 4.2.23 20260609.1
CVE-2025-59682 low — django 4.2.23 20260609.1
CVE-2025-68142 low — pymdown-extensions 10.4 20260609.1
CVE-2026-1285 low — django 4.2.23 20260609.1
CVE-2026-25674 low — django 4.2.23 20260609.1
CVE-2026-34073 low — cryptography 45.0.5 20260609.1
CVE-2026-4277 low — django 4.2.23 20260609.1
CVE-2026-4292 low — django 4.2.23 20260609.1
CVE-2026-4539 low — pygments 2.19.2 20260609.1
GHSA-4fx9-vc88-q2xc low — pillow — 20260609.1
CVE-2022-29361 unknown — werkzeug 0.16.1 20260609.1
OSV-2022-1074 unknown — pillow — 20260609.1
OSV-2022-715 unknown — pillow — 20260609.1
PYSEC-2023-175 unknown — pillow — 20260609.1

Showing 257 of 257

Beta — feedback welcome: [email protected]