← Scan another repo

github.com/SeleniumHQ/selenium

@ d9b34242b65b

Submitted 8/4/2026, 10:28:00 AM · Status: ok

Risk grade
F
100 / 100
Findings
218
1 critical27 high75 medium9 low106 info0 on CISA KEV0ATT&CK
Showing 218 of 218 findings

Findings

  • Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
    grypeCVE-2025-14813EPSS 0.3%
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    grypeCVE-2026-14257EPSS 0.3%
  • brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    grypeCVE-2026-14257EPSS 0.3%
  • brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    grypeCVE-2026-14257EPSS 0.3%
  • brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    grypeCVE-2026-69152
  • brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    grypeCVE-2026-69152
  • brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    grypeCVE-2026-69152
  • cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
    grypeCVE-2026-69247
  • React Router vulnerable to XSS via Open Redirects
    grypeCVE-2026-22029EPSS 0.8%
  • Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
    grype
  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepthird_party/closure/goog/base.js:1096
  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepthird_party/closure/goog/base.js:3535
  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepthird_party/closure/goog/json/json.js:122
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/gitpod/.gitpod.Dockerfile:33
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/gitpod/.gitpod.Dockerfile:22
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/remote-image/Dockerfile:40
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/remote-image/Dockerfile:21
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/dev-image/Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyscripts/dev-image/Dockerfile:15
  • @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects
    React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can res…
    trivyCVE-2026-22029
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…
    trivyCVE-2026-14257
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…
    trivyCVE-2026-14257
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled in…
    trivyCVE-2026-69152
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled in…
    trivyCVE-2026-69152

This report is public.