Skip to content
Tools / SoulSync / Security

Security Deep Dive

SoulSync

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects 2.6.5.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

20 versions tracked
Version Published C H M L KEV Notes
2.6.5 2026-06-01 — — — — —
Latest
2.6.4 2026-05-30 — — — — —
—
2.6.3 2026-05-28 — — — — —
—
2.6.2 2026-05-27 — — — — —
—
2.6.1 2026-05-24 — — — — —
—
2.6.0 2026-05-24 — — — — —
—
2.5.9 2026-05-22 — — — — —
—
2.5.7 2026-05-20 — — — — —
—
2.5.6 2026-05-19 — — — — —
—
2.5.5 2026-05-18 — — — — —
—
2.5.4 2026-05-17 — — — — —
—
2.5.3 2026-05-14 — — — — —
—
2.5.2 2026-05-14 — — — — —
—
2.5.1 2026-05-13 — — — — —
—
2.5.0 2026-05-11 — — — — —
—
2.4.2 2026-05-07 — — — — —
Patches CVE-2023-4863
2.4.1 2026-05-01 — 1 — — KEV 1
—
2.4.0 2026-04-26 — 1 — — KEV 1
—
2.3 2026-04-12 — 1 — — KEV 1
—
2.2 2026-04-02 — 1 — — KEV 1
—
— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 1d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 23d ago
Release cadence: weekly Present
1d median over recent releases Release history
Latest release: 2d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 2d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 2d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 2d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 2d ago
0.5/10 Security Score
Dependency Exposure 140 transitive dependency CVEs found in the latest SBOM. 10 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.933

freshness

1.00 / 1.0

2d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 10c/61h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 2d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.933
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
10 Transitive critical CVEs
1 KEV-transitive CVEs
100% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2023-4863 HIGH 99%ile — 2.4.2 — — KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

32 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

10

High

61

Medium

44

Low

22

Unknown

3

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (0) All (140)
Critical 10 High 61 Medium 44 Low 22 Unknown 3
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2014-3007 critical — pillow — 2.4.2
CVE-2016-4009 critical — pillow — 2.4.2
CVE-2020-11538 critical — pillow — 2.4.2
CVE-2020-5310 critical — pillow — 2.4.2
CVE-2020-5311 critical — pillow — 2.4.2
CVE-2020-5312 critical — pillow — 2.4.2
CVE-2021-25289 critical — pillow — 2.4.2
CVE-2021-34552 critical — pillow — 2.4.2
CVE-2022-22817 critical — pillow — 2.4.2
CVE-2023-50447 critical — pillow — 2.4.2
CVE-2014-1932 high — pillow — 2.4.2
CVE-2014-3589 high — pillow — 2.4.2
CVE-2014-3598 high — pillow — 2.4.2
CVE-2014-9601 high — pillow — 2.4.2
CVE-2016-0775 high — pillow — 2.4.2
CVE-2016-2533 high — pillow — 2.4.2
CVE-2016-3076 high — pillow — 2.4.2
CVE-2016-9190 high — pillow — 2.4.2
CVE-2016-9243 high — cryptography — 2.4.2
CVE-2018-1000164 high — gunicorn — 2.4.2
CVE-2018-1000656 high — flask — 2.4.2
CVE-2018-10903 high — cryptography — 2.4.2
CVE-2018-18074 high — requests — 2.4.2
CVE-2019-1010083 high — flask — 2.4.2
CVE-2019-16865 high — pillow — 2.4.2
CVE-2019-18874 high — psutil — 2.4.2
CVE-2019-19911 high — pillow — 2.4.2
CVE-2020-10177 high — pillow — 2.4.2
CVE-2020-10378 high — pillow — 2.4.2
CVE-2020-10379 high — pillow — 2.4.2
CVE-2020-10994 high — pillow — 2.4.2
CVE-2020-25659 high — cryptography — 2.4.2
CVE-2020-35653 high — pillow — 2.4.2
CVE-2020-35654 high — pillow — 2.4.2
CVE-2020-36242 high — cryptography — 2.4.2
CVE-2020-5313 high — pillow — 2.4.2
CVE-2021-23437 high — pillow — 2.4.2
CVE-2021-25287 high — pillow — 2.4.2
CVE-2021-25288 high — pillow — 2.4.2
CVE-2021-25290 high — pillow — 2.4.2
CVE-2021-25291 high — pillow — 2.4.2
CVE-2021-25293 high — pillow — 2.4.2
CVE-2021-27921 high — pillow — 2.4.2
CVE-2021-27922 high — pillow — 2.4.2
CVE-2021-27923 high — pillow — 2.4.2
CVE-2021-28675 high — pillow — 2.4.2
CVE-2021-28676 high — pillow — 2.4.2
CVE-2021-28677 high — pillow — 2.4.2
CVE-2022-24303 high — pillow — 2.4.2
CVE-2022-30595 high — pillow — 2.4.2
CVE-2022-45198 high — pillow — 2.4.2
CVE-2022-45199 high — pillow — 2.4.2
CVE-2023-0286 high — cryptography — 2.4.2
CVE-2023-30861 high — flask — 2.4.2
CVE-2023-38325 high — cryptography — 2.4.2
CVE-2023-44271 high — pillow — 2.4.2
CVE-2023-4863 high KEV pillow — 2.5.0
CVE-2023-50782 high — cryptography — 2.4.2
CVE-2024-1135 high — gunicorn — 2.4.2
CVE-2024-23334 high — aiohttp — 2.4.2
CVE-2024-26130 high — cryptography — 2.4.2
CVE-2024-28219 high — pillow — 2.4.2
CVE-2024-30251 high — aiohttp — 2.4.2
CVE-2024-6827 high — gunicorn — 2.4.2
CVE-2025-27154 high — spotipy — 2.4.2
CVE-2025-48379 high — pillow — 2.4.2
CVE-2025-69223 high — aiohttp — 2.4.2
CVE-2026-25990 high — pillow — 2.4.2
CVE-2026-26007 high — cryptography — 2.4.2
CVE-2026-40192 high — pillow — 2.4.2
CVE-2026-42311 high — pillow — 2.4.2
CVE-2014-1829 medium — requests — 2.4.2
CVE-2014-1830 medium — requests — 2.4.2
CVE-2014-1933 medium — pillow — 2.4.2
CVE-2015-2296 medium — requests — 2.4.2
CVE-2016-0740 medium — pillow — 2.4.2
CVE-2016-9189 medium — pillow — 2.4.2
CVE-2020-35655 medium — pillow — 2.4.2
CVE-2021-25292 medium — pillow — 2.4.2
CVE-2021-28678 medium — pillow — 2.4.2
CVE-2022-22815 medium — pillow — 2.4.2
CVE-2022-22816 medium — pillow — 2.4.2
CVE-2023-23608 medium — spotipy — 2.4.2
CVE-2023-23931 medium — cryptography — 2.4.2
CVE-2023-32681 medium — requests — 2.4.2
CVE-2023-37276 medium — aiohttp — 2.4.2
CVE-2023-47627 medium — aiohttp — 2.4.2
CVE-2023-49081 medium — aiohttp — 2.4.2
CVE-2023-49082 medium — aiohttp — 2.4.2
CVE-2023-49083 medium — cryptography — 2.4.2
CVE-2024-0727 medium — cryptography — 2.4.2
CVE-2024-23829 medium — aiohttp — 2.4.2
CVE-2024-27306 medium — aiohttp — 2.4.2
CVE-2024-35195 medium — requests — 2.4.2
CVE-2024-42367 medium — aiohttp — 2.4.2
CVE-2024-47081 medium — requests — 2.4.2
CVE-2024-52303 medium — aiohttp — 2.4.2
CVE-2024-52304 medium — aiohttp — 2.4.2
CVE-2025-69227 medium — aiohttp — 2.4.2
CVE-2025-69228 medium — aiohttp — 2.4.2
CVE-2025-69229 medium — aiohttp — 2.4.2
CVE-2025-71176 medium — pytest — 2.4.2
CVE-2026-22815 medium — aiohttp — 2.4.2
CVE-2026-25645 medium — requests — 2.4.2
CVE-2026-34515 medium — aiohttp — 2.4.2
CVE-2026-34516 medium — aiohttp — 2.4.2
CVE-2026-34525 medium — aiohttp — 2.4.2
CVE-2026-39892 medium — cryptography — 2.4.2
CVE-2026-42308 medium — pillow — 2.4.2
CVE-2026-42309 medium — pillow — 2.4.2
CVE-2026-42310 medium — pillow — 2.4.2
GHSA-39hc-v87j-747x medium — cryptography — 2.4.2
GHSA-h4gh-qq45-vh27 medium — cryptography — 2.4.2
GHSA-jgpv-4h4c-xhw3 medium — pillow — 2.4.2
GHSA-pjjw-qhg8-p2p9 medium — aiohttp — 2.4.2
CVE-2021-21330 low — aiohttp — 2.4.2
CVE-2023-47641 low — aiohttp — 2.4.2
CVE-2024-12797 low — cryptography — 2.4.2
CVE-2025-47278 low — flask — 2.4.2
CVE-2025-53643 low — aiohttp — 2.4.2
CVE-2025-66040 low — spotipy — 2.4.2
CVE-2025-69224 low — aiohttp — 2.4.2
CVE-2025-69225 low — aiohttp — 2.4.2
CVE-2025-69226 low — aiohttp — 2.4.2
CVE-2025-69230 low — aiohttp — 2.4.2
CVE-2026-27205 low — flask — 2.4.2
CVE-2026-34073 low — cryptography — 2.4.2
CVE-2026-34513 low — aiohttp — 2.4.2
CVE-2026-34514 low — aiohttp — 2.4.2
CVE-2026-34517 low — aiohttp — 2.4.2
CVE-2026-34518 low — aiohttp — 2.4.2
CVE-2026-34519 low — aiohttp — 2.4.2
CVE-2026-34520 low — aiohttp — 2.4.2
GHSA-4fx9-vc88-q2xc low — pillow — 2.4.2
GHSA-5cpq-8wj7-hf2v low — cryptography — 2.4.2
GHSA-jm77-qphf-c4w8 low — cryptography — 2.4.2
GHSA-v8gr-m533-ghj9 low — cryptography — 2.4.2
OSV-2022-1074 unknown — pillow — 2.4.2
OSV-2022-715 unknown — pillow — 2.4.2
PYSEC-2023-175 unknown — pillow — 2.4.2

Showing 140 of 140

Beta — feedback welcome: [email protected]