results.xml

<?xml version="1.0" encoding="utf-8"?>
<checkstyle version="1.5">
    <file name="golang/go.mod">
        <error
            source="vulnerability_medium"
            line="7"
            message="Insecure dependency golang/golang.org/x/net@v0.16.0 (CVE-2023-44487: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)) (update to 0.17.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="7"
            message="Insecure dependency golang/golang.org/x/net@v0.16.0 (CVE-2023-45288: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS) (update to 0.23.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="7"
            message="Insecure dependency golang/golang.org/x/net@v0.16.0 (CVE-2025-22870: golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net) (update to 0.36.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="7"
            message="Insecure dependency golang/golang.org/x/net@v0.16.0 (CVE-2025-22872: golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net) (update to 0.38.0)"
            severity="warning"
        />
        <!-- stdlib -->
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2023-39326: golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests) (update to 1.21.5)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-24791: net/http: Denial of service due to improper 100-continue handling in net/http) (update to 1.21.12)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2023-45289: golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect) (update to 1.21.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2023-45290: golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm) (update to 1.21.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-24783: golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm) (update to 1.21.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-24784: golang: net/mail: comments in display names are incorrectly handled) (update to 1.21.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-24785: golang: html/template: errors returned from MarshalJSON methods may break template escaping) (update to 1.21.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-24789: golang: archive/zip: Incorrect handling of certain ZIP files) (update to 1.21.11)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-34155: go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion) (update to 1.22.7)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message='Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-34158: go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion) (update to 1.22.7)'
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-45336: golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect) (update to 1.22.11)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-45341: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints) (update to 1.22.11)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-22866: crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec) (update to 1.22.12)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-22871: net/http: Request smuggling due to acceptance of invalid chunked data in net/http) (update to 1.23.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall) (update to 1.23.10)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-4673: net/http: Sensitive headers not cleared on cross-origin redirect in net/http) (update to 1.23.10)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-47906: os/exec: Unexpected paths returned from LookPath in os/exec) (update to 1.23.12)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-58185: encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-58189: crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-61723: encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-61725: net/mail: Excessive CPU consumption in ParseAddress in net/mail) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-47912: net/url: Insufficient validation of bracketed IPv6 hostnames in net/url) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-61724: net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-58188: crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-58186: golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http) (update to 1.24.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-58187: crypto/x509: Quadratic complexity when checking name constraints in crypto/x509) (update to 1.24.9)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-61727: golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs) (update to 1.24.11)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-22873: os: os: Information disclosure via path traversal using specially crafted filenames) (update to 1.23.9)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-61730: During the TLS 1.3 handshake if multiple messages are sent in records  ...) (update to 1.24.12)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped in html/template) (update to 1.25.8)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32288: archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive) (update to 1.25.9)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32289: html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals) (update to 1.25.9)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-22870: golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net) (update to 1.23.7)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="3"
            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32282: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root) (update to 1.25.9)"
            severity="warning"
        />
    </file>

    <file name="gradle/gradle.lockfile">
        <error
            source="vulnerability_medium"
            line="1"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2025-68161: Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification) (update to 2.25.3)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="1"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="1"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34480: org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging) (update to 2.25.4)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="1"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34477: org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification) (update to 2.25.4)"
            severity="warning"
        />
    </file>

    <file name="java/pom.xml">
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2025-68161: Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification) (update to 2.25.3)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34480: org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging) (update to 2.25.4)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34477: org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification) (update to 2.25.4)"
            severity="warning"
        />
    </file>

    <file name="javascript/package-lock.json">
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2020-28168: nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address) (update to 0.21.1)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="14"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2023-45857: axios: exposure of confidential data stored in cookies) (update to 0.28.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="23"
            message="Insecure dependency npm/follow-redirects@1.15.6 (GHSA-r4q5-vmmm-2653: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets) (update to 1.16.0)"
            severity="warning"
        />
    </file>

    <file name="javascript/yarn.lock">
        <error
            source="vulnerability_medium"
            line="5"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2020-28168: nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address) (update to 0.21.1)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="5"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2023-45857: axios: exposure of confidential data stored in cookies) (update to 0.28.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="5"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="5"
            message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="12"
            message="Insecure dependency npm/follow-redirects@1.15.6 (GHSA-r4q5-vmmm-2653: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets) (update to 1.16.0)"
            severity="warning"
        />
    </file>

    <file name="python/Pipfile.lock">
        <error
            source="vulnerability_medium"
            line="131"
            message="Insecure dependency pypi/requests@2.30.0 (CVE-2023-32681: python-requests: Unintended leak of Proxy-Authorization header) (update to 2.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="131"
            message="Insecure dependency pypi/requests@2.30.0 (CVE-2024-35195: requests: subsequent requests to the same host ignore cert verification) (update to 2.32.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="131"
            message="Insecure dependency pypi/requests@2.30.0 (CVE-2026-25645: requests: Requests: Security bypass due to predictable temporary file creation) (update to 2.33.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="131"
            message="Insecure dependency pypi/requests@2.30.0 (CVE-2024-47081: requests: Requests vulnerable to .netrc credentials leak via malicious URLs) (update to 2.32.4)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="140"
            message="Insecure dependency pypi/urllib3@2.2.2 (CVE-2025-50181: urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation) (update to 2.5.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="140"
            message="Insecure dependency pypi/urllib3@2.2.2 (CVE-2025-50182: urllib3: urllib3 does not control redirects in browsers and Node.js) (update to 2.5.0)"
            severity="warning"
        />
    </file>

    <file name="python/requirements.txt">
        <error
            source="vulnerability_medium"
            line="2"
            message="Insecure dependency pypi/requests@v2.30.0 (CVE-2023-32681: python-requests: Unintended leak of Proxy-Authorization header) (update to 2.31.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="2"
            message="Insecure dependency pypi/requests@v2.30.0 (CVE-2024-35195: requests: subsequent requests to the same host ignore cert verification) (update to 2.32.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="2"
            message="Insecure dependency pypi/requests@v2.30.0 (CVE-2024-47081: requests: Requests vulnerable to .netrc credentials leak via malicious URLs) (update to 2.32.4)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="2"
            message="Insecure dependency pypi/requests@v2.30.0 (CVE-2026-25645: requests: Requests: Security bypass due to predictable temporary file creation) (update to 2.33.0)"
            severity="warning"
        />
    </file>

    <file name="ruby/Gemfile.lock">
        <error
            source="vulnerability_medium"
            line="4"
            message="Insecure dependency gem/puma@6.3.0 (CVE-2023-40175: rubygem-puma: HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers) (update to ~> 5.6.7, >= 6.3.1)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="4"
            message="Insecure dependency gem/puma@6.3.0 (CVE-2024-21647: rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies) (update to ~> 5.6.8, >= 6.4.2)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="4"
            message="Insecure dependency gem/puma@6.3.0 (CVE-2024-45614: rubygem-puma: Header normalization allows for client to clobber proxy set headers) (update to ~> 5.6.9, >= 6.4.3)"
            severity="warning"
        />
    </file>

    <file name="rust/Cargo.lock">
        <error
            source="vulnerability_medium"
            line="1"
            message="Insecure dependency cargo/sqlx@0.8.0 (GHSA-xmrp-424f-vfpx: SQLx Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts) (update to 0.8.1)"
            severity="warning"
        />
    </file>

    <file name="scala/build.sbt.lock">
        <error
            source="vulnerability_medium"
            line="13"
            message="Insecure dependency maven/com.twitter/twitter-server_2.12@20.10.0 (CVE-2020-35774: TwitterServer Cross-site Scripting via /histograms endpoint) (update to 20.12.0)"
            severity="warning"
        />
    </file>

    <file name="swift/Package.resolved">
        <error
            source="vulnerability_medium"
            line="67"
            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (CVE-2023-44487: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)) (update to 1.28.0)"
            severity="warning"
        />
        <error
            source="vulnerability_medium"
            line="67"
            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (GHSA-xvr7-p2c6-j83w: swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability) (update to 1.38.0)"
            severity="warning"
        />
    </file>
</checkstyle>