Skip to content
Tools / trulens / Security

Security Deep Dive

trulens

Security posture and CVE patch evidence from tracked releases.

Back to Tool

No known vulnerabilities in trulens-2.8.1.

1 CVE patched in tracked history.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

7 versions tracked
Version Published C H M L KEV Notes
trulens-2.8.1 2026-05-14
Latest Patches CVE-2026-42208
trulens-2.8.0 2026-04-30 1 KEV 1
trulens-2.7.2 2026-04-09 1 KEV 1
trulens-2.7.1 2026-03-10 1 KEV 1
trulens-2.7.0 2026-02-19 1 KEV 1
trulens-2.6.0 2026-02-04 1 KEV 1
trulens-2.5.3 2026-01-15 1 KEV 1
— Signed — SLSA — SBOM ✗ Security policy Monthly cadence · 19d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
SLSA provenance Unknown
Attestation predicate level Latest release
SBOM published Unknown
GitHub SBOM API Latest release
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 23d ago
Release cadence: monthly Present
19d median over recent releases Release history
Latest release: 20d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 3d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 20d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 20d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 20d ago
0.8/10 Security Score

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

Max EPSS 0.569

freshness

1.00 / 1.0

3d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 39c/101h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 3d

Operational risk

operational risk

1.5

10%

kev exposure: detected epss max: 0.569
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
0 Transitive critical CVEs
0 KEV-transitive CVEs
39% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2026-42208 CRITICAL 98%ile trulens-2.8.1 KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

2340 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

0

High

0

Medium

0

Low

0

Unknown

0

No dependency CVEs match this filter.

Showing 0 of 295

Beta — feedback welcome: [email protected]