Provally

Unvalidated session ID obtained from cookies is passed directly to the storage backend. This can lead to injection attacks in backends like Memcached where special characters are not appropriately escaped by default. Ensure the format and length of the session ID are validated prior to lookup.

Dynamically creating Jinja2 templates using 'jinja2.Template' without a sandboxed environment can lead to Server-Side Template Injection (SSTI) and arbitrary code execution if the template string is attacker-controlled. Use 'jinja2.sandbox.SandboxedEnvironment' instead.

A Django form field parses JSON input within `to_python` but lacks dictionary structure validation in its `validate` method. In components such as `AttributesFormField`, failing to validate dict keys (e.g. against a blocklist of dangerous HTML attributes) during form validation allows malicious inputs to bypass model-level checks if model `full_clean()` is n

Serving potentially large files over gRPC by buffering the entire content into memory and returning an `httpbody.HttpBody` can lead to Out-Of-Memory (OOM) Denial of Service and missed HTTP headers (e.g., Content-Disposition). Consider migrating file serving to a dedicated streaming HTTP server.

Using `Iterator::all()` on string-like elements (e.g., via `.chars()` or `.bytes()`) returns `true` for empty iterators. If this is used for string validation without an explicit length or emptiness verification, empty strings will unexpectedly pass validation checks. Ensure the length of the string is explicitly asserted prior to or during the `.all()` eval

Passing an unbounded string to `secure_filename()` can cause a Denial of Service (DoS) on Windows due to the expensive NFKD Unicode normalization loop. Verify the length of the string before calling `secure_filename()`, or slice the string to a safe length (e.g. `filename[:255]`).

Unconditional restoration of IR_FSTORE for a table metatable. Failing to handle an IR_KNULL (null metatable) can cause memory corruption resulting in Denial of Service (DoS) when the unverified null pointer is processed by the VM or Garbage Collector. Ensure that metatables check for IR_KNULL before unsinking to an object reference.

A custom escape function is used to embed data into an HTML attribute within a JavaScript template string. Many custom HTML escape functions (such as `escapeHtml`) fail to adequately escape quotation marks (`"` and `'`), allowing attackers to break out of the attribute block and inject malicious scripts. Use a robust sanitization library like `xss` (`filterX

Unbounded decompression using `zlib.decompress` without checking the size of the compressed data can lead to a Denial of Service (DoS) attack (zip bomb). An attacker can provide a small, highly compressed payload that consumes massive amounts of memory and CPU when decompressed. Check the length of the compressed data before decompressing, or use `zlib.decom

Reading the entirety of a compressed data stream using `ioutil.ReadAll` or `io.ReadAll` can lead to a Denial of Service (DoS) vulnerability due to unbounded memory allocation (e.g., zip bomb attack). Instead, constrain the maximum expected decompressed size by using `io.LimitReader` combined with `ReadAll`, or loop manually over `Read` checks verifying paylo

Retrieving an uploaded file's content type using `content_type` and coercing it to a string without properly parsing or sanitizing it allows attackers to supply multiple comma-separated MIME types. This can bypass allowlists and lead to Cross-Site Scripting (XSS) when the file is eventually served to users. Wrap the content type in a parser like `Marcel::Mim

Computing a diff with an uninitialized BaseObject drops XClassReference context, leading to potential exposure of sensitive properties like password hashes.

Found Perl string concatenation (`."`) mistakenly used inside backticks. Backticks in Perl interpolate variables natively. Using string concatenation operators inside them results directly in literal dots and quotes being sent to the shell without matching quotes. This generates shell parsing errors (unterminated quoted string) and prevents commands from exe

Explicitly setting the SUID bit on installed binaries grants elevated privileges to any executing user. If the underlying binary can process user-controlled inputs, environment variables, or arguments, this setup trivially enables absolute Local Privilege Escalation (LPE) to the file owner's context (often root). Ensure this configuration is intentional, or

The 'vsprintf' function formats data into a buffer without bounds checking. This can lead to stack or heap buffer overflows if the formatted output exceeds the buffer size. Use 'vsnprintf' with a defined max size or 'vasprintf' to dynamically allocate a safely sized buffer instead.

Datastore records are being extracted and cast to strings without HTML escaping. When this structured data is returned via AJAX and rendered by frontend plugins (like DataTables), it could lead to Stored Cross-Site Scripting (XSS). Ensure that all extracted record values are wrapped in `html.escape()` or an equivalent escaping mechanism.

Registering `Oauth2HttpRequestParamsDecorator` as a data sink decorator allows attackers to exfiltrate OAuth2 client secrets from the provider's vault. The consumer-provided clientSecretKey is resolved in the context of the provider's vault, and its value is sent to a consumer-controlled URL as part of the OAuth2 client credentials grant.

Unsanitized user input from HTTP requests is used directly in a file system operation. This can allow attackers to read, write, or delete arbitrary files by using path traversal sequences (e.g., `../`). Ensure the input is sanitized using `basename()` or `realpath()` before incorporating it into file paths.

Directly using `child_process.spawn` with `cmd.exe` and passing dynamically constructed arguments leads to Command Injection on Windows. `spawn` does not appropriately escape arguments for `cmd.exe`. Malicious inputs containing characters like `&`, `|`, or `;` can execute arbitrary commands alongside the intended one. Use `child_process.exec` with careful ma

Unsanitized data converted to CSV format and sent to users can result in a CSV/Formula Injection vulnerability if malicious input starts with '=', '+', '-', or '@'. Spreadsheet applications may execute these as formulas. Avoid manual CSV construction with `.to_csv` or the standard `CSV` library when handling unvalidated user data. Instead, use a library that

Missing sanitization of style attributes extracted from XLSX files before HTML rendering.

Double quotes or unquoted variables injected into a PowerShell command string can lead to command injection. PowerShell evaluates subexpressions like `$(...)` inside double quotes. Ensure that user input is properly escaped (e.g., doubling single quotes) and wrapped in single quotes within the PowerShell command.

Repeated parsing of a massive JSON document due to a lack of memoization and failure to skip already-processed report types during pipeline vulnerability ingestion, which led to CPU and memory exhaustion (DoS).

The application passes user-controlled data to a Node.js asynchronous filesystem API (like `fs.stat`) without wrapping the call in a `try/catch` block. In Node.js, passing invalid characters such as null bytes (`%00`) to `fs` functions can cause a synchronous exception to be thrown before the async callback is invoked. Without a `try/catch`, this unhandled e

Missing depth limit in recursive HTTP redirect handling. Recursively following HTTP redirects without maintaining and checking a recursion depth limit allows an attacker to cause an infinite redirect loop (DoS). Add a depth counter parameter and reject if it exceeds a maximum threshold.

Missing enforcement of `onlyPskDheKe` flag during PSK handshake logic.

Assigning `shell=True` conditionally (e.g., based on OS like Windows) introduces a risk of OS command injection when processing unsanitized arguments. Instead of using `shell=True` to suppress console windows on Windows, explicitly assign `shell=False` and use `creationflags=subprocess.CREATE_NO_WINDOW`.

An LDAP search filter is constructed using unsanitized user input. This can lead to LDAP injection vulnerabilities, allowing an attacker to alter the query logic and bypass authentications or cause a Denial of Service (DoS). Ensure that all user inputs passed to LDAP search queries are sanitized using `escape_filter_chars` from `ldap3.utils.conv` or `ldap.fi

The LDAP TLS configuration defaults to `ssl.CERT_NONE`, disabling server certificate validation. This enables Man-in-the-Middle (MitM) attacks. Ensure `ssl.CERT_REQUIRED` is used by default, and only fallback to `ssl.CERT_NONE` conditionally through deliberate user configuration.

A custom address parsing routine appears to extract email addresses using regular expressions without properly ensuring that the text is not part of a quoted string. This can lead to email routing vulnerabilities when attackers embed malicious addresses within quoted local-parts.

A bounds check uses a subtraction which can lead to integer underflow. If `$SIZE` is greater than `$LEN`, `$LEN - $SIZE` will wrap around to a large positive value (if unsigned), bypassing the length validation and causing an out-of-bounds read or write. Use addition instead (`$PTR + $SIZE <= $LEN`) or check the size against the remaining offset explicitly (

The parser function recursively processes nested tokens without a depth limit, making it vulnerable to a stack exhaustion Denial of Service (DoS) via deeply nested input.

The application invokes the WinGUp updater without explicitly enforcing cryptographic signature checks. An attacker in a privileged network position could intercept the HTTP(S) update request and serve a malicious executable payload, leading to arbitrary code execution. Ensure that '-chkCertSig=yes' is passed.

Pebble versions < 4.1.0 are vulnerable to Local File Inclusion (LFI) via the `include` tag due to an unrestricted `FileLoader` configured by default. An attacker with template modification privileges can read arbitrary local files on the server. Remediate by upgrading to Pebble >= 4.1.0, manually assigning a strict loader (e.g., `ClasspathLoader`), or explic

Generation of multipart boundaries using the cryptographically insecure `Math.random()` was detected. Boundary values can be predicted and used to inject malicious parts into the multipart request if they are sent to an attacker-controlled server alongside legitimate endpoints.

Grouping security scan results solely by `scanner` identity without `scan_type` causes collisions between different report types (e.g., SBOM and DS). This can lead to legitimate vulnerabilities being erroneously marked as resolved or no longer detected. Use a composite key including both `scanner` and `report_type`.

The application reads a file completely into memory before checking its size. This can lead to memory exhaustion (Denial of Service) if an attacker provides a maliciously large file. Enforce file size constraints before reading the file, such as by using `fs.stat()` or `fs.statSync()`.

Setting explicitly world-writable permissions (e.g., 0o777 or 0o666) on files or directories can result in local privilege escalation or unauthorized modification. If a privileged service writes to a world-writable directory, local attackers can use symlink attacks to overwrite critical system files. Rely on safe default permissions (umask) or restrict write

The application sets an authentication-related session key without first invalidating or regenerating the session. This can lead to session fixation attacks where an attacker supplies a known session identifier, leading to unauthorized access. Call `$session->invalidate()` or `$session->regenerateToken()` before setting authentication state.

The Shiro configuration applies a global filter chain but does not include a CSRF or XSRF filter. Cross-Site Request Forgery (CSRF) can occur when a framework relies on session cookies for authentication without validating predictable tokens or restricting cross-origin submission. Add a custom CSRF filter to your Shiro filter chain definition configuration f

A TPM signature structure is accessed for HMAC operations (reading `any.hashAlg` and accessing `hmac.digest`) without validating that the signature algorithm tag (`sigAlg`) is actually `TPM_ALG_HMAC`. This can lead to an out-of-bounds memory read due to union type confusion. Always verify the signature algorithm type.

A key iteration loop attempts to prevent prototype pollution by blocking the '__proto__' key but fails to block the 'constructor' key. This allows attackers to execute Prototype Pollution attacks by injecting 'constructor.prototype' changes, which may lead to arbitrary code execution or logic bypass.

The 'srcdoc' attribute is missing from the list of stripped attributes. When configuring an HTML sanitizer (such as SimplePie) to allow `<iframe>` tags, failing to strip the 'srcdoc' attribute can lead to Cross-Site Scripting (XSS) since it allows executing JavaScript within the iframe. Ensure that 'srcdoc' is explicitly included in the attributes to strip.

A buffer copy bound is computed using the capacity of one buffer but applied during an append operation to a different buffer. If the destination buffer is smaller than the calculated remaining space, this mismatch will lead to a buffer overflow. Calculate availability space using the actual destination buffer.

A method in a PromptValue (or similar parser context) inherently trusts user items and dispatches them directly to file open or URL fetching functions. If an attacker controls part of the retrieved contexts, this causes Arbitrary File Read (via file:// or direct path) and SSRF. Ensure that paths/URLs are sanitized by enforcing allowed protocols and network l

Setting `ReadOnlyPort` to 0 in Kubelet configuration structs causes the field to be stripped during JSON serialization due to the upstream `omitempty` tag. As a result, kubelet ignores the 0 value and binds to the default unauthenticated port (10255), exposing sensitive cluster information. Set the read-only port dynamically via CLI flags (e.g., `--read-only

A slice is compacted and cleared using an external function before being placed into a map. When processing large user-controlled inputs (like HTTP headers), this can cause redundant slice modifications and GC pressure. Prefer deduplicating directly into the map in a single pass.

Constructing shell output strings and validating them with a flawed greedy regex pattern allows command injection. The regex uses a greedy `.*` pattern inside single quotes for values, meaning an attacker can craft a key containing an equals sign (`=`) to cause the regex to misidentify the key-value boundary, bypassing validation.

Constructing paths using `os.path.join` with unsanitized user input (such as URL parameters) can lead to path traversal vulnerabilities. An attacker may supply path traversal sequences (e.g., `../`) to access files outside the intended directory. Use Django's `safe_join` from `django.utils._os` instead to restrict target locations.

A blocklist approach is used to remove HTTP headers. This is insecure because new or lesser-known sensitive headers (e.g., 'Authorization', 'X-Api-Key') will bypass this filter and be forwarded or logged, potentially leading to credential theft. Implement a strict allowlist by iterating over all request headers and preserving only those explicitly marked as

Directly passing the result of `getOutput` to a container insertion method like `push_back` without checking for null can lead to a null pointer dereference later when the container elements are accessed. Assign the return value to a variable and verify it is not null before inserting.

A cycle detection mechanism was found that throws or returns upon detecting a duplicate, but lacks a corresponding limit on the collection's size. When this collection represents traversal depth or inclusion history, lacking a size bound can lead to Stack Exhaustion (CWE-674) or Uncontrolled Resource Consumption (CWE-400) via deeply nested structures. Enforc

Early dispatch or return based solely on the presence of OAuth parameters (`code`, `state`, `error`) without validating state or checking for HTTP parameter pollution allows CSRF and authorization bypass. Verify state parameters explicitly and check for parameter pollution (e.g., using `getlist`) before processing OAuth callbacks.

Constructing OS commands with string interpolation and executing them via a shell (e.g., `child_process.exec`) can lead to command injection. In `git-mcp-server`, an attacker could inject shell metacharacters or command substitutions (e.g., `$(...)`) even within double quotes. Use `child_process.execFile` or `child_process.spawn` and pass arguments as an arr

Constructing shell commands dynamically and passing them to `execSync` or `exec` can lead to command injection. Instead, use `execFileSync` or `execFile` (or `spawn`) and pass arguments as an array to prevent shell metacharacter evaluation by the OS.

Missing validation for HTTP/2 Data frames on stream 0. RFC 7540 designates that DATA frames must be associated with a stream greater than 0, as stream 0 is strictly reserved for connection control. Processing DATA frames on stream 0 can lead to uncontrolled memory usage. Ensure the stream ID is checked (e.g., `sid > 0`) when handling DATA frames.

Extracting a local path from a 'file://' scheme and passing it directly to a filesystem function causes an Arbitrary File Read / Path Traversal vulnerability if the URI is user-supplied.

A Go `http.Server` was instantiated without a `ReadHeaderTimeout` or `ReadTimeout`. This can leave the server vulnerable to Slowloris attacks (CWE-400), where an attacker holds connections open by sending headers very slowly. Always configure a `ReadHeaderTimeout`.

The HttpPayloadParser instantiation is missing the `headers_parser` argument. In pure-Python versions of aiohttp prior to 3.12.14, trailer sections in chunked requests were discarded without structural validation, leading to HTTP request smuggling (CVE-2025-53643) as front-end proxies might interpret the malformed payload differently. Ensure a capability to

The script creates or configures a Windows service using `sc` but fails to properly escape the `binPath` value. Because `sc.exe` strips the outermost quotes during argument parsing, passing a normally-quoted string (like `"%PATH%"`) results in the service's registry ImagePath being saved without quotes. If the path evaluated at runtime contains spaces, this

Directly using a `.filename` attribute in path construction without sanitization can lead to path traversal vulnerabilities (such as File Upload traversal or Zip Slip). Ensure the filename is safely processed using `secure_filename()` or `os.path.basename()` before filesystem operations.

The application decodes URL paths and assigns them directly to environment variables (like PATH_INFO) or uses them in file operations without normalization. This can allow an attacker to bypass directory boundary checks and access arbitrary files on the filesystem via directory traversal sequences (such as "..").

A potentially sensitive route ($PATH) is registered without a middleware wrapper (e.g., `negroni.New()`). This pattern can lead to authorization bypass or information disclosure if authentication is meant to be enforced. Ensure that sensitive endpoints are protected by the appropriate authentication middleware.

Detected file or directory operation on a path constructed via path joining without explicit bounds checking. This can lead to path traversal (CWE-22) if the components are user-controlled. Ensure that bounds are verified using `isWithin` before accessing it.

Direct parsing of untrusted user input into a regular expression engine can lead to a Regular Expression Denial of Service (ReDoS). Attackers can submit crafted regex payloads that perform catastrophically poor evaluations. Use safe static string evaluations or sanitize the input via `re.escape()`.

Writing to a hardcoded or predictable path in a world-writable directory (like /tmp/) can lead to local privilege escalation or file corruption via symlink attacks (CWE-379). Use the built-in `tempfile` module (e.g., `tempfile.NamedTemporaryFile` or `tempfile.mkstemp`) to create temporary files securely.

A missing validation check allows parallel reduction to take place underneath a SIMD-vectorized loop, leading to generated C++ code that can encounter a buffer overflow. Ensure parallel reductions are disabled under SIMD-vectorized loops when recalculating the `start_depth` for loops.

Unsanitized dictionary keys are parsed into child queries. By providing a dictionary with uppercase SQL functions (e.g., `{\"COUNT(...)\": [\"field\"]}`), an attacker may bypass string-based query sanitization and inject arbitrary SQL. Reject dict keys that map strictly uppercase components or explicitly handle SQL function generation boundaries before passi

A missing null check for `preset` during legato mode detection can lead to a null pointer dereference later when notes are processed.

Global multiline regex replacement of lone curly braces `{` or `}` (such as via `replace(/^\s*[{}]\s*$/gm, ...)`) will strip braces globally from data structures, including those inside code blocks or structured documents. This causes major structural data corruption. Perform line-by-line context-aware checks or use a parsing AST to preserve code boundaries.

A PJSIP authorization header gets fetched and its fields (like `credential`) are immediately dereferenced to initialize another variable without first verifying the pointer is not NULL. This can lead to a segmentation fault if the header is missing or invalid.

The HTTP decoder allows standalone Line Feed (LF) characters as line terminators for chunk delimiters and header lines, skipping arbitrary bytes. This violates HTTP/1.1 RFC requirements (which mandate CRLF) and enables HTTP Request Smuggling when fronted by a proxy network that handles LF properly. Ensure that chunks and header parsers strictly enforce the p

The QuoRem implementation performs division via truncation (using `Div`) instead of symmetric rounding. This mathematically violates the Euclidean domain property, leading to infinite loops in Half-GCD operations (Denial of Service). Additionally, mutating the receiver `z` early before completion can lead to aliasing bugs if it points to the same memory as t

The use of `child_process.exec` (or its promisified versions) with variable interpolation allows an attacker to inject shell commands via metacharacters like `;`, `|`, or `&&`. This leads to Remote Code Execution (RCE). Instead, use `child_process.execFile` and pass arguments as an array, bypassing the shell runtime evaluation.

Extracting paths from URLs using fixed character offsets based on assumptions about scheme lengths can lead to interpretation conflicts and path confusion. Malformed URIs might cause the extractor to yield an incorrect path, potentially bypassing upstream proxy path-based ACLs. Use a dynamically calculated offset based on a protocol separator (e.g., `url.ind

The code validates a path or workspace against directory traversal ("..") and URL encoding character discrepancies, but fails to check for shell tilde ("~") expansion. If this variable is passed without escaping to a shell environment, attackers can exploit tilde expansion to access unauthorized filesystem paths or inject commands. Add `strings.HasPrefix(val

Linearly unrolling a repetition or quantifier using uncontrolled bounds from input can lead to resource exhaustion and Denial of Service (DoS) if an attacker provides a very large upper/lower bound. Introduce an unbounded repeat AST node type or enforce a strict ceiling on loop boundaries.

A method constructs and returns a file path using user input without verifying the resulting file against an explicit allow-list. In restricted contexts (like file shares), this can allow attackers to access unauthorized sibling files or bypass directory-level restrictions (CWE-862). Ensure that file access boundaries are enforced by validating the path agai

Dynamically generated file paths via the internal templating engine are resolved without boundary validation. If user input is injected into the template, it can cause the resolved path to escape the restricted server directories (Path Traversal/LFI). Ensure paths are securely resolved and bound-checked using `startsWith` against their intended base environm

Use of a potentially NULL flow context parameter without prior checking.

Returning an error code such as ARCHIVE_FATAL directly from a parsing function without setting an error string can lead to a NULL pointer dereference when clients query the error string. Route error paths through a common block that sets the error string via archive_set_error() before returning.

Comparing an authentication token (like the Authorization header) using standard equality operators (`in`, `not in`, `==`, `!=`) can lead to a timing side-channel. These operators short-circuit and leak the length of the matching prefix, allowing an attacker to guess the token character by character. Use `secrets.compare_digest` or `hmac.compare_digest` inst

Failing to drop Initial encryption keys prior to or while dropping Handshake keys can lead to an assertion failure and Denial of Service (DoS). A malicious server might prematurely confirm the handshake (e.g., by sending a HANDSHAKE_DONE frame early), leaving unexpected Initial keys in the state. Ensure `protocol.EncryptionInitial` keys are explicitly droppe

Unescaped variable inside a prefix-anchored regex used for string substitution. If the variable origins from configuration or unconstrained input and contains regex metacharacters, the match or replacement might fail and expose internal logic or paths like directories. Always safely escape interpolated variables in regex replacements using `Regexp.escape(...

Untrusted input is passed directly to `TeamSpeak.connect()` without validation or sanitization. Malicious input, such as specially crafted Unicode characters, can cause exceptions during underlying ASCII conversion, leading to a Denial of Service (DoS) crash. Sanitize and validate connection options (e.g., host, port) before passing them to the connection me

Submitting an unvalidated array of answers to `Polls.handleRespondToPollReqMsg` allows a Denial-of-Service (DoS) via resource exhaustion. The inputs must be constrained in length or uniqueness according to the specific configuration flag before processing.

Direct unvalidated access to dynamic keys in `@emoji-mart/data` can cause an unhandled TypeError if a user-supplied key does not exist. This can lead to a Denial of Service (DoS) by crashing the application. Validate the key (e.g., check if it exists) or use optional chaining before accessing nested properties.

Interpolating an unescaped variable into a regular expression for prefix stripping can fail if the variable contains regex metacharacters (e.g. `+`, `?`, `*`). This can lead to path disclosure or incorrect string manipulation. Use `Regexp.escape` to safely interpolate literal strings into regular expressions.

Unescaped regex interpolation in path replacement. When an unescaped variable is interpolated into a regular expression (e.g., `/\A#{var}/`) to strip a prefix, regex metacharacters in the variable (like `+` or `.`) will cause the replacement to fail silently. This can lead to sensitive path disclosures, such as leaking the webserver's absolute root directory

Detected unescaped variable interpolation within a regular expression used for path/prefix substitution. If the variable contains regular expression metacharacters, the substitution can match unintended segments of the target string. In the context of directory paths, this can lead to absolute path disclosure or incorrect logic. Use `Regexp.escape()` or `Reg

Unescaped regex interpolation used in string replacement. If the interpolated variable contains regex metacharacters, the match may fail or behave unexpectedly. When stripping base paths, this can lead to absolute path disclosure. Use `Regexp.escape()` or `Regexp.quote()` to safely interpolate variables into regular expressions.

The token splitting logic does not impose a restriction on the input string length before performing cryptographic or base64 decoding preparation. An attacker can supply an excessively large token to exhaust memory or CPU resources, resulting in a Denial of Service (DoS). Validate the length of the string `len(...) <= LIMIT` before proceeding with parsing.

Splitting an untrusted string with the regular expression `/\s*,\s*/` can lead to Regular Expression Denial of Service (ReDoS) or excessive CPU consumption. An attacker providing a maliciously crafted string (e.g., many consecutive spaces without commas) can trigger worst-case execution time in the regex engine. Instead, split by the comma character literall

AST node visitors unconditionally delegate via `self.deref().accept()` without checking for Error variants. This may cause panics during traversal of malformed input, leading to a Denial of Service condition. Ensure the delegation logic wraps the call in an Error variant check (e.g., `if !matches!(self, Type::Error(_))`).

FreshRSS authentication bypass logic detected. The application checks whether a token parameter is non-empty without validating it against the user's expected secret, and uses another user-provided parameter to switch the user context. This allows an authentication bypass for anonymous attacks.

Detected an mpv argument list that does not explicitly include '--no-ytdl'. By default, mpv will attempt to execute 'youtube-dl' or 'yt-dlp' to resolve network stream links. In scenarios where user-controlled files or unverified directories are present, this can lead to arbitrary code execution if an attacker supplies a malicious executable matching the down

Direct interpolation of variables into SQL strings enclosed in single quotes was detected. This bypasses parameterization and may lead to SQL injection. Use parameterized queries such as `?` or `$1` instead.

Unbounded accumulation of data using write() in a decode loop without length limits can lead to memory exhaustion and Denial of Service (decompression bombs). Implement size constraints and raise an exception if limits are exceeded. [ignoring loop detection]

Detected unsafe access to the alert queue `p->alerts.alerts` at index `p->alerts.cnt` without checking if `p->alerts.cnt < packet_alert_max`. If the queue is full (`p->alerts.cnt == packet_alert_max`), accessing this index leads to a heap-based out-of-bounds read and can crash the engine.

`DetectEngineBufferTypeGetNameById` can return NULL for registry buffer types like `base64_data`. Passing its result directly into `VarNameStoreRegister` or utilizing it without a NULL validation results in a NULL pointer dereference, crashing the Suricata engine.

A path parameter is directly substituted into a URL template without URL-encoding. This can allow an attacker to inject path traversal sequences (e.g., '../') or query parameters, leading to Server-Side Request Forgery (SSRF) and path traversal. Ensure the parameter value is encoded using `urllib.parse.quote()` before substitution.

Unbounded iteration from a sequence number up to a sequence number set's `base()`. In RTPS and DDS protocols, an attacker can craft a gap message with a huge difference between the start and base sequence numbers. This causes memory exhaustion (OOM) when arbitrary sequence numbers are inserted into internal states, or high CPU consumption due to massive O(N)

A function intended to perform a subset check uses `.some()` instead of `.every()`. A subset check requires that all elements of the first set exist in the second set (logical AND). Using `.some()` changes this to an intersection check (logical OR). In access control logic, missing this distinction can lead to security bypasses (e.g., CVE-2025-64530) by allo

Spawning child processes with 'shell: true' via 'foreground-child' can lead to OS command injection if arguments (like filenames) contain shell metacharacters. Ensure untrusted inputs are properly escaped, or avoid using 'shell: true' by passing arguments directly or correctly wrapping with a shell explicitly.

A size check successfully prevents an oversized variable from being processed, but the entire untruncated variable is then embedded into the raised exception. If this exception is captured by error tracking systems or logs, it can lead to Denial of Service (DoS) and memory exhaustion. Refactor the code to omit the raw oversized payload from the exception mes

A globally hardcoded OpenSSL ENGINE instance restricts the application to a single hardware or custom cryptographic module configuration. This structural limitation can lead to failed handshakes or inappropriate cryptographic states when different engines are required. Ensure `ENGINE *` instances are dynamically injected or passed by reference.

Missing validation for the presence of the NodeID Information Element. A missing NodeID in PFCP messages may lead to a nil pointer dereference when calling `.NodeID()`, causing the process to panic and resulting in a denial-of-service (DoS) condition. Check that `$X.NodeID != nil` before attempting to read its value.

Returning a `nil` response when a PFCP Information Element (IE) fails to parse causes the UPF to silently drop the request instead of sending a proper rejection. This can lead to state inconsistency and denial-of-service (timeouts) for the peering node. Instead of returning `nil`, construct and return a valid response containing an appropriate rejection caus

Serving internal files or custom HTTP bodies via `*httpbody.HttpBody` in gRPC handlers can lead to authentication bypass or deserialization vulnerabilities when exposed through gRPC-Gateway. Refactor the endpoint to serve binary file downloads or specific HTTP streams using standard dedicated HTTP handlers (e.g., `http.HandlerFunc`) rather than processing th

Calling `mach_vm_deallocate` with parameters typed or cast as `vm_size_t` or `vm_address_t` instead of `mach_vm_size_t` and `mach_vm_address_t` causes pointer truncation on Apple 64-bit platforms, leading to a memory leak via failed deallocation. Use the `mach_vm_*` type variants for all arguments.

Uncontrolled recursion detected. The recursive function takes a depth parameter but does not validate it against a maximum threshold. A deeply nested structure could trigger stack exhaustion and lead to a Denial of Service (DoS).

Frappe query builder parses fields into queries but skips sanitization on keys when a dictionary is passed. This allows SQL payloads to masquerade as child queries. Validations such as `isupper()` checks must be implemented to prevent arbitrary injection or unexpected function calls.

Directly creating decoders or decompressors from a split string without limiting the number of elements can lead to an unbounded decompression chain. This is a Denial of Service (DoS) vulnerability. Extract the split array, check its length against a safe maximum, and then instantiate the decoders.

Use of legacy DToA formatting algorithms (`DToA.JS_dtostr` or `DToA.JS_dtoa`) is vulnerable to an algorithmic complexity Denial of Service (CVE-2025-66453) when handling small floating-point values. Replace legacy DToA calls with `DecimalFormatter` or modern formatting libraries.

The application uses `strings.Split` on a '.' character to parse a token or dot-separated input without limiting the split count or first validating the number of delimiters. A malicious payload containing thousands of '.' characters can cause unbounded memory allocations, leading to a Denial of Service (DoS). Use `strings.SplitN(token, ".", 3)` to restrict

A cryptographic verification function accesses raw signature data (`$SIG.data()`) without explicitly validating its length first. This can lead to a buffer over-read (CWE-125) if the underlying cryptographic API expects a minimum buffer length. Ensure that the length of the buffer is verified before passing its `.data()` pointer to C-style APIs.

The nftables backend configuration in a Go application (like the CNI portmap plugin) omits the 'fib daddr type local' instruction in the prerouting or output chain. This oversight allows traffic not destined for the node/host to be incorrectly intercepted and NAT-forwarded if rules match solely on port numbers. This defect can lead to unintended Man-in-the-M

A decompression match offset is checked for negative values (`< 0`) but not for zero before being subtracted from the current output pointer. If the offset is exactly zero, the decompressor may read from the current output index instead of a valid previous sequence. This causes it to copy uninitialized or residual buffer bytes into the uncompressed stream, p

Repeatedly counting characters in a string from index 0 up to an advancing boundary inside a loop causes quadratic time complexity O(N^2). This is a common vulnerability pattern when parsing quoted string headers and can be exploited for Denial of Service (DoS) with large inputs. Track the substring matches incrementally tracking lower-bounds without always

A quadratic time complexity (O(n^2)) vulnerability exists due to recalculating quote counts from the start of a string inside a loop. Since Python's `cgi` module was deprecated, this vulnerable pattern was often copied into third-party libraries. An attacker can cause a Denial of Service (DoS) by providing a maliciously crafted header parameter containing ma

Unconditional inclusion of the Client ID in the allowed audience list can allow ID tokens to be accepted in place of Access Tokens. This leads to authentication bypass. Ensure the Client ID is only appended if the token type is not an Access Token.

Directly accessing the `Params` map on a potentially absent SIP header via `.To()` or the internal `.to` field without first validating that the header is not nil can cause a nil pointer dereference. This leads to a panic and a Denial of Service (DoS) condition. Extract the header to a local variable and check if it is nil before accessing `.Params`.

A URL loaded from user input is fetched without validating that the hostname is not an internal IP address. This can lead to Server-Side Request Forgery (SSRF). Consider parsing the URL and checking the host with filter_var using FILTER_VALIDATE_IP to reject invalid or internal hosts.

Incorrect assertion that the lookup key matches the browser key, which can crash on CNAME records.

The code asserts that two object fields are null (indicating an uninitialized or free state), and then subsequently assigns to one of them. If the execution path reaching this assertion can be triggered multiple times via external input, the assertion will fail and crash the application (Denial of Service). Replace this assertion with proper conditional logi

In WeasyPrint before 68.0, URL fetching allowed automatic HTTP redirects, potentially bypassing SSRF protections when using custom URL fetchers. `default_url_fetcher` is vulnerable and deprecated. Use `URLFetcher` with `allow_redirects=False` to securely control redirection and prevent SSRF bypasses.

Dictionary keys are being iteratively extracted and passed directly to an object constructor (e.g., an AST node or query builder class) without prior validation. If the dictionary originates from a user-supplied JSON payload, attackers can insert arbitrary function calls, code, or payload strings as keys. Validate keys using an allowlist or character asserti

Substitution of parameters into a URL or path string without URL encoding. Malicious parameter values like '../' could lead to path traversal or SSRF. Sanitize parameter values using `urllib.parse.quote()` before replacing them in the URL template.

Unbounded decompression was detected. Decompressing data without a `max_length` parameter can lead to a Denial of Service (DoS) via "zip bomb" memory exhaustion. Configure a safe `max_length` parameter to limit the size of the decompressed output.

Using `assert` for critical data validation or state checks (such as end-of-file boundaries, stream validation, or field presence) is unsafe. When Python is executed with optimizations enabled (`-O` or `PYTHONOPTIMIZE=1`), all `assert` statements are stripped. This allows malformed data to bypass checks entirely, potentially leading to infinite loops or Deni

A size or accumulator variable is unexpectedly reset to 0 inside an asynchronous chunk/field processing loop. This invalidates global request body size validation by only validating individual chunks, which can lead to memory exhaustion (Denial of Service). Ensure accumulator variables are initialized outside the loop.

Detected a potential integer truncation when computing a byte size from an element size and count. By computing `sizeof(T) * count` and implicitly or explicitly mapping it to a 32-bit integer, the product can overflow the 32-bit limit on platforms where size_t is 64 bits. This results in a severely shorter computed length. If this truncated value is subseque

Path traversal leading to insecure deserialization. Using `os.path.join` with uncontrolled inputs and passing the result directly to an `open` call before deserializing with `pickle.loads` allows attackers to bypass boundary checks and execute arbitrary code. Validate paths using `os.path.realpath` and verify directory prefixes before opening.

Accessing a tuple via `tuple_index` without an `is_null()` check after casting with `as_tuple()`. This can lead to a Null Pointer Dereference DoS if the underlying VM parameter is not a tuple.

Child VM gas limit is not bounded by the parent's actual remaining gas. This allows a gas accounting discrepancy leading to unexpected OOG exceptions that can pollute or corrupt virtual machine states.

Unrestricted deserialization of internal TVM types like Continuations detected. When an attacker supplies a malicious Continuation object and it is successfully deserialized and executed, it consumes excessive CPU resources while accruing disproportionately low virtual gas costs. This monopolizes processing power and results in a Denial of Service (DoS) for

The Shiro configuration configures filter chains without including CSRF protection. Apache Shiro does not provide built-in CSRF defense natively, requiring manual filter configuration. Ensure a custom CSRF filter is added to the Shiro filter chains to protect state-changing requests against Cross-Site Request Forgery (CSRF).

Time-of-Check to Time-of-Use (TOCTOU) vulnerability detected. Calling `stat()` and then `chmod()` on the same path without `follow_symlinks=False` allows an attacker to swap a file or directory with a symbolic link between the two calls. This can lead to arbitrary file permission alteration or privilege escalation. Ensure you pass `follow_symlinks=False` to

Deserialization of untrusted data via `unserialize()` can lead to PHP Object Injection. An attacker can pass a serialized PHP object, which may execute arbitrary code or exfiltrate data if a Property-Oriented Programming (POP) chain is present. Use `json_decode()` instead.

Direct interpolation of object properties into a WordPress database query without passing them through `$wpdb->prepare()` can lead to SQL injection. Object properties often store unsanitized user or API inputs. Ensure all dynamic variables are properly escaped and parameterized.

Grouping vulnerabilities solely by scanner omits the scan/report type, leading to collisions between different scanners (e.g., DS and SBOM). This can cause active vulnerabilities to be improperly marked as resolved due to hash key collisions.

A byte count is padded to a block size using `divmod` without validating if the count is negative. In Python, `divmod` with a negative dividend and positive divisor yields a negative quotient. This can result in negative padded lengths that propagate into file offsets or buffer sizes, potentially leading to backwards-seeking pointer errors, infinite loops, o

A subtraction expression is cast to `size_t` and used in a bounds check. If the subtraction yields a negative result, the cast to `size_t` will underflow to a large positive value, bypassing the intended bounds check. Instead of `(size_t)($Y - $Z)`, perform the arithmetic after casting or rearrange the comparison to use addition.

The hunspell 'locale' parameter is fetched from user-controlled index settings and passed directly to HunspellService.getDictionary() without validation. An attacker with privileges to configure index settings can craft a locale parameter containing path traversal sequences (e.g. '../') to read arbitrary files or manipulate cache keys. Validate the locale us

A Time-of-Check to Time-of-Use (TOCTOU) race condition occurs when a file's permissions are modified by path after it has been opened. An attacker can replace the file with a symbolic link between the open and permission modification calls, potentially altering permissions of unintended, arbitrary files. To fix this, use file-descriptor-based functions (e.g.

Fetching an HTTP response body entirely into memory without a size limit can cause resource exhaustion (OOM/DoS) vulnerabilities. An unauthenticated attacker might provide a URL pointing to an aggressively large file or an endless stream to crash the host machine. Instead of using `.bytes()` or `.text()` directly on an HTTP response without validation, limit

The application uses a statically hard-coded string as a fallback for a JWT or session secret when the environment variable is not configured. This allows an attacker to bypass authentication by signing a forged JSON Web Token (JWT) or session cookie using the known default secret. To fix, require the environment variable to be set, or dynamically generate a

Dynamically dispatching recursive parsing operations using `methodcaller` can bypass recursion depth limits tracked in centralized parsing methods. This can lead to uncontrolled recursion (DoS). Ensure that nested structures are routed through methods that actively enforce recursion depth limits.

A regular expression blocklist explicitly blocks `sudo` but does not include `doas`. Hardcoded command blocklists are inherently incomplete and prone to bypasses (CWE-184). A missing check for `doas` can allow arbitrary command execution as root if the binary is present in the environment (e.g., `doas apk` or `doas sh`). Consider using an allow-list, robust

Directly calling `extractall()` on an untrusted ZIP archive without supplying a safely filtered `members` list can result in a Zip Slip vulnerability. Attackers can include paths such as `../` within the archive to write arbitrary files outside the intended destination directory. To remediate, iterate over the archive's `infolist()` and validate that each re

Extracting ZIP archives using `zipfile.ZipFile.extractall()` without validating archive members can lead to path traversal vulnerabilities (Zip Slip). An attacker can craft a ZIP file containing path traversal sequences (like `../`) to overwrite arbitrary files on the system. To avoid this, either use a sanitized list of members via the `members` argument, o

The form listener processes unsubscribe requests without authorization verification.

This rule is a placeholder. The original vulnerability was a logic flaw in a specific custom CSRF middleware implementation that was completely removed and replaced. It cannot be represented as a general static analysis rule.

When draining an HTTPResponse connection, calling `read()` without explicitly disabling `decode_content` can cause unnecessary decompression of the response body. This leaves the client vulnerable to decompression bomb DoS attacks when processing untrusted HTTP redirects. Explicitly pass `decode_content=False` or the current decoder state to prevent unbounde

An array is allocated using a size directly from a method parameter without an explicit upper bound check wrapping the allocation. If the size is controlled by an attacker during parsing or deserialization, this can lead to unbounded memory allocation, OutOfMemoryError, and Denial of Service (DoS). Validate the size against a reasonable threshold before allo

A loop decrements its counter by the result of a read operation without checking if the read returned 0. If the read fails or reaches end-of-file (EOF), it may return 0, causing the loop counter to never reach 0 and resulting in an infinite loop (Denial of Service). Ensure there is a break or return condition that asserts the read payload length is greater t

An object spread operator (`...$X`) placed after explicitly defined properties can overwrite those properties. When preceding properties act as access-control or identity boundaries (e.g., `$KEY`), a Mass Assignment vulnerability can occur if the spread object contains user-controlled keys. Attackers can bypass authorization by overriding these IDs. Move the

Missing bounds check for a packet extension header size prior to accessing its internal length field. This can cause an out-of-bounds read, potentially leading to a Denial of Service or unauthorized information disclosure.

The Valkey/Redis module initialization function is missing the `HANDLE_IO_ERRORS` option. Valkey modules are required to handle errors in RDB parsing by setting this flag. If this flag is not set, errors encountered during parsing result in a system assertion which shuts down the system (Denial of Service). To mitigate this, call `ctx.set_module_options(Modu

Outdated referenced section in comments.

An IP restriction blocklist is defined using array literals of `IPAddr` instances without explicitly accommodating IPv4-mapped IPv6 addresses. This can allow Server-Side Request Forgery (SSRF) if an attacker uses the `::ffff:` prefix for an IPv4 address (e.g. `::ffff:127.0.0.1`), bypassing pure IPv4 ranges. Ensure that `.ipv4_mapped` variants are explicitly

Transaction progress check relies on the 'complete' flag instead of 'done'. This may lead to memory leaks on errored or malformed transactions that are never marked as 'complete' and thus never freed by the application layer framework.

Dynamically looking up a property on the global object and instantiating or calling it can lead to Remote Code Execution (RCE) if the property name is user-controlled. An attacker could resolve and instantiate arbitrary global constructors such as `Function`. Use an explicit allowlist (e.g., an object map) of safe constructors instead.

The application configures a WebSocket upgrader to bypass origin validation by unconditionally returning 'true' in 'CheckOrigin'. This exposes the WebSocket server to Cross-Site WebSocket Hijacking (CSWSH). Remove the 'CheckOrigin' field to enforce the default same-origin policy, or implement strict comparison of the 'Origin' header against a whitelist of tr

Unchecked `split_at` or `split_at_mut` on slices can cause a panic if the index represents an out-of-bounds position. When processing untrusted parser inputs or ciphertexts, this missing bounds check triggers Rust unwinding and results in a Denial of Service (DoS). Consider using `split_at_checked` or `split_at_mut_checked` which return an `Option` for safe

A dynamically resolved constructor from a global object is invoked with unvalidated input. If the constructor acts as a TypedArray and the input is maliciously crafted as a large number instead of an ArrayBuffer or valid array-like object, the JavaScript engine will perform a length-based allocation. This causes excessive memory initialization, leading to De

Data payload meant for ArrayBuffer decoding should be verified to be a string. Omitting this type validation can allow an attacker to provide a non-string type to trigger unexpected behavior or bypass logic.

Eagerly allocating a buffer based on an unverified length before asynchronously reading chunks can lead to Denial of Service (DoS) via memory exhaustion. Defend against this by deferring allocation until all chunks are successfully read or validating the requested length against known HTTP Content-Length bounds.

Validating path inclusion via a string prefix match (`start_with?`) on an expanded path can cause a directory traversal vulnerability. Since directory names are not boundary-checked, a path like '/foo_bar' will match the prefix '/foo'. Ensure you append a trailing directory separator to the prefix before checking or use `==` for exact matches.

The P2P message handler unmarshals receipts directly into fully-decoded object representations (indicated by casting objects to full structure arrays). Processing unbounded P2P receipts dynamically during memory hashing can lead to a Denial of Service (DoS) via an Out-of-Memory (OOM) crash. Avoid explicit casting to fully allocated slice types (e.g., `types.

Repeatedly invoking an allocation-heavy function like `types.DeriveSha` inside a loop over external network data without a shared buffer pool can lead to massive garbage collection overhead and Denial of Service (CVE-2026-22868).

Aborting an archive extraction loop upon encountering a validation error can lead to scanner evasion if the extracted files are intended for security analysis. Attackers can place an invalid file before malicious ones to prevent them from being extracted and scanned. Use `continue` to skip invalid entries instead of aborting the process if building a scanner

The authorization logic incorrectly checks the role of the requested target (e.g., user record) instead of the current authenticated session context. This can lead to an IDOR (Authorization Bypass) where unprivileged users can access privileged records by requesting them. Ensure that the authorization condition verifies the role of the current requesting use

The code parses ASN.1 OID/RELATIVE-OID continuation octets without a limit on the number of octets processed per arc. This bounded loop allows arbitrary precision integers to grow infinitely via left bitwise shifts, resulting in excessive resource consumption (memory and CPU) when parsing untrusted ASN.1 payloads, potentially leading to a Denial of Service.

A database session or connection is created and closed manually but is not wrapped in a `try...finally` block. If an exception occurs before `.close()` is called, the connection will leak. Over time, leaked connections can exhaust the connection pool and cause a Denial of Service (DoS). Ensure that you wrap the usage in a `try...finally` block and call `.clo

Detected unsanitized path construction using `Path.join` followed by a filesystem operation. Constructing directory paths from user-controlled inputs using `Path.join` can lead to relative path traversal. Use `Path.safe_relative/2` to sanitize inputs or ensure they stay within the intended base directory.

A specific regular expression designed for parsing diff headers is vulnerable to ReDOS via overlapping match groups spanning line terminators. Furthermore, utilizing this strict regex for extraction inside an uncontrolled loop following a looser boundary check can induce infinite loops (causing DoS) if the regex fails to match input that triggered the loop l

An uploaded file is accessed without prior validation. Direct usage of `FILES` without an explicit validation function can lead to unrestricted file uploads, enabling Stored XSS or Remote Code Execution. Ensure the file's MIME type and extension are securely validated before processing its attributes or saving it locally.

A new lookup node is created and processed without checking for CNAME loops, which could lead to unbounded recursion.

The object returned by `get_MsConfig` is owned by the device object. Explicitly freeing it with `msusb_msconfig_free` causes a use-after-free vulnerability when the device object later dereferences the dangling pointer. Do not free this structure directly.

A use-after-free condition can occur if the `formats` array is freed but an active alias referencing one of the formats (e.g. `audin->format`) is not explicitly cleared. Concurrent threads accessing this dangling pointer may lead to a crash or arbitrary code execution. Ensure the active format is set to NULL before calling `audio_formats_free`.

A cleanup function was called with an additive duplicate variable expression (`$X + $X`). This is heavily indicative of a typo for a loop index or single variable `$X` (e.g., `i + i` instead of `i`). Calling a cleanup function with an accidentally doubled size or index overestimates initialized bounds, leading to out-of-bounds memory accesses and corrupted m

Resources are freed via StreamPool_Return or audio_formats_free without prior termination of the plugin/context thread. This causes a use-after-free if the background thread accesses these resources. Ensure thread synchronization (e.g., WaitForSingleObject, or a helper termination function) occurs before freeing context fields.

A logic flaw causes incorrect rounding when both the intermediate product and divisor are negative. The logic assumes a negative intermediate implies a negative result, neglecting the sign of the divisor. Attackers could trigger this path to cause precision deviations and break expected math boundaries.

A stack space management bug in the Lua engine fails to pop elements before generating an error. This can lead to an out-of-bounds write if exploited via recursive or memory-intensive string operations.

Missing check for JCS_RGB565 color space when setting up the color quantizer. The 2-pass color quantizer does not correctly handle JCS_RGB565, which can lead to a heap-based buffer overflow. Ensure the condition also checks `out_color_space == JCS_RGB565` to safely skip or error out when attempting 2-pass quantization on RGB565 data.

Infinite loop vulnerability in Tonelli-Shanks algorithm implementation. The loop terminates using an exact equality check (`i == e`) combined with an increment (`i++`) before the check. If `e` is 1, `i` increments to 2 and bypasses the `e` check. When the evaluated modulo is not prime, this bypass causes the loop to run indefinitely, leading to a Denial of S

Using `strings.HasPrefix` with `filepath.Clean` to check if a path is within a directory boundary is insecure. This allows attackers to bypass the check using a peer directory with the same prefix (e.g., `/app/base-pwned/..` successfully bypasses a check for `/app/base`). Use `filepath.Rel` instead, and ensure it does not return an error or begin with `..`.

The application lacks strict ownership validation and authorization boundaries for file/folder operations. Authenticated users could bypass access controls.

Unbounded memory allocation based on multiplied dimensions ($W * $H), which can lead to Out-Of-Memory (OOM) and DoS when processing malicious inputs (like images). Ensure that the allocated size is constrained to a reasonable maximum before creating the array.

Unchecked addition in bounds or capacity check. If the addition wraps around due to integer overflow, the bounds check might incorrectly succeed. In Rust release mode, standard addition wraps. This can lead to incorrect state invariants, undersized buffer allocations, out-of-bounds writes, and Undefined Behavior. Use `.checked_add()` and handle the overflow

Git argument injection detected. A user-controlled variable is passed to a git command without using the `--` end-of-options separator. This can allow an attacker to inject git command-line flags (e.g., `--upload-pack`) leading to remote code execution. Ensure `--` is used before any dynamic arguments.

Using `Picker.route` registers the route handler for all HTTP methods (GET, POST, PUT, DELETE). This lack of method-level boundaries can lead to authorization bypasses if an endpoint designed and checked only for read access accepts a state-modifying request. Migrate to specific HTTP method handlers like `WebApp.handlers.get()` or `WebApp.handlers.post()`.

`SimpleCookie.load()` or `BaseCookie.load()` can raise a `CookieError` on malformed inputs. If this method is called on user-supplied data without a `try...except` block, it can cause an unhandled exception, leading to a Denial of Service (DoS). Wrap the `load()` call in a `try...except` block to handle exceptions safely.

A pointer `$P` is logged after its memory has been freed. This Use-After-Free (UAF) can trigger crashes with strict memory-checking tools (e.g., ASAN) and indicates unsafe memory lifecycle management. Reorder the code to log before freeing, or do not access the pointer after deallocation.

Uncontrolled mutual recursion (CWE-674) in standard parser combinators. The functions recursively call each other when parsing nested grammar elements without tracking recursion depth. An attacker can craft deeply nested inputs (such as repeating parenthesis) to exhaust the call stack, resulting in Denial of Service (DoS) via stack overflow.

Constructing file paths via `filepath.Join` using unvalidated object properties (e.g., `.Path` or `.Filename`) can lead to arbitrary file read or path traversal if the property is attacker-controlled. Use a secure, non-traversable identifier like a UUID instead.

The application retrieves an LLM-generated SQL query (e.g., from an agent tool's attribute) and executes it directly via a database session without prior validation. This is vulnerable to prompt injection, which could allow an attacker to bypass LLM guardrails and execute dangerous commands (e.g., `COPY ... PROGRAM` or `INTO OUTFILE`), resulting in Remote Co

Missing middleware to reject suspicious encoded characters, which can lead to path confusion and bypass of access controls in reverse proxies.

Access control checks that compare the output of `filepath.Rel` against string literals using case-sensitive equality (`==`) can be bypassed on case-insensitive file systems (e.g., Windows). An attacker can supply a mixed-case file name (such as 'cOnf.json') which fails the equality check but remains resolvable by the OS, leading to sensitive file exposure.

Routing OAuth flows based solely on the presence of parameters like 'state' or 'code' in the request allows attackers to bypass CSRF protections. In OAuth callbacks, it is crucial to securely extract the parameter values (e.g., using `getlist` to prevent HTTP parameter pollution) and perform a cryptographic or strict equality comparison of the received 'stat

Unsafe execution of dynamic commands using `child_process.exec`. Shell metacharacters can be used for command injection. Use `trim`, `spawn` or `execFile` instead to pass arguments safely as an array instead of a concatenated shell string.

A schema validation allows an 'any' type for a payload data field (such as :data or :file). In Clojure, polymorphic I/O APIs such as `io/input-stream` or `slurp` natively treat Strings as file paths rather than raw string data. If this loosely typed payload is subsequently passed to a polymorphic I/O function, an attacker could supply a string representing a

Using `matches!` or `assert_matches!` with a simple lowercase identifier as the pattern evaluates to `true` unconditionally (or always passes the assertion). In Rust, lowercase identifiers in patterns act as irrefutable variable bindings, bypassing any intended value comparison. This can lead to severe security vulnerabilities if used for validation. If you

The XML internal subset/DOCTYPE parser lacked mechanisms to limit or track nested entity expansions (such as entityExpansionCount and currentExpandedLength). This omission allows evaluating unchecked recursive or massive macro structures from an external payload, resulting in a Denial of Service via memory/CPU exhaustion (Billion Laughs).

An improper bounds check clamps a buffer size or length by subtracting the end index ($X) from the limit ($LIMIT) when $X > $LIMIT. This results in a negative value that, if cast to an unsigned size, causes an integer underflow and massive out-of-bounds reads or writes. To fix this, clamp by subtracting the start index from the limit (e.g., $LIMIT - $START).

Directly calling free() on an xfAppWindow pointer obtained via xf_rail_add_window or xf_rail_get_window leaves a dangling pointer in the railWindows hash table. This will result in a use-after-free or double-free on disconnect cleanup. Let the table lifecycle handle the freeing of this pointer instead.

Advancing a string or stream pointer via `Stream_Seek` without checking its bounds after an alignment calculation allows out-of-bounds skips. This could lead to a crash (e.g. `WINPR_ASSERT`) via unvalidated stream operations. Use `Stream_SafeSeek` instead, which securely enforces bounds limits.

During server-side rendering (SSR), dynamic HTML tag names are directly interpolated into the HTML output string without validation. If 'tag' is controlled by an attacker, they can supply malicious characters (like spaces and angle brackets) to break out of the tag context and inject arbitrary HTML attributes or elements, leading to Cross-Site Scripting (XSS

Repeatedly splitting string parameters inside a comparison helper can lead to CPU DoS if called inside a large loop (such as verifying many x509 certificate SAN entries). To prevent this quadratic overhead, parse/split the loop-invariant variable once before the loop and pass the resulting slice (e.g., []string) to this function.

Overwriting sensitive module mode from user input without authorization check

An HTTP client is explicitly configured to follow HTTP redirects automatically. If initial URLs are validated against SSRF but redirect URLs are not, an attacker could return a redirect pointing to an internal service, bypassing the SSRF filter. Set `follow_redirects=False` (or `allow_redirects=False`) and validate redirect targets manually against the SSRF

Unbounded memory allocation detected when creating a sequence of bytes. Without validating the requested size, an attacker can specify a disproportionately large size parameter, resulting in an Out-Of-Memory (OOM) denial of service. Ensure the size argument is validated against permitted bounds (e.g., via `check_write()`) before allocation.

A vector is declared, populated, and then drained for manual cleanup entirely within an async block. If the async block contains early returns (like `?`), the manual cleanup loop may be bypassed, leading to resource leaks. Consider declaring the vector outside the async block and performing the cleanup after the async block has resolved.

An unbounded memory allocation was found using `iter::repeat().take()` driven by a function parameter. If this parameter is attacker-controlled (e.g., from WebAssembly guest inputs), it can cause memory exhaustion (OOM) and lead to Denial of Service (DoS) of the host environment. Ensure the parameter is checked against a dynamic stream limit or defined upper

The Parse Dashboard AI Agent endpoint (`/apps/:appId/agent`) is exposed without authentication or CSRF protection. This allows unauthenticated remote attackers to perform arbitrary database operations using the master key.

A function parameter is directly passed to `filepath.Abs` and returned without any subsequent validation. If the parameter is user-controlled, this can enable path traversal, allowing attackers to access or modify files anywhere on the backend filesystem by supplying absolute paths or path traversal sequences. Either use `filepath.Base()` to extract just the

Potential infinite loop detected. Loop iterates over xref/trailer offsets without tracking and validating visited offsets to prevent circular references (CVE-2026-27628).

The validation logic erroneously uses a chain of 'else if' statements to check for missing parameters. This captures and reports only the first missing parameter, returning it in the error response. Attackers can exploit this to iteratively probe the server and map internal validation logic or service dependencies.

The domain validation logic checks if a hostname ends with an allowed domain without validating that the check is an exact domain match or a proper subdomain (prepended with a dot). An attacker could bypass the check by registering a domain that ends with the allowed domain name (e.g., 'attacker-example.com' for 'example.com'). Update the logic to ensure exa

Detected unbounded zlib decompression of a PDF object or stream. Using `zlib.decompress` on untrusted stream attributes (e.g., `_data`, `data`, or `get_data()`) without reinforcing limits makes the application highly vulnerable to decompression bombs (zip bombs), leading to memory exhaustion and Denial of Service (DoS) attacks. Implement bounded decompressio

Directly assigning an unsanitized hash/array lookup to a `filename` key can lead to Path Traversal (CWE-22) vulnerabilities when processed by file upload or storage libraries. Attackers can supply path traversal characters (e.g., `../`) to save or overwrite files outside the intended directory. Sanitize the user-supplied filename using `File.basename(...)`.

Relying solely on the `.is_private` attribute of an `ipaddress` object is insufficient to block all internal network ranges. It neglects link-local addresses (e.g., 169.254.169.254 used for cloud metadata), loopback addresses, and reserved networks, potentially allowing SSRF bypasses. You must also verify `.is_loopback`, `.is_link_local`, and `.is_reserved`

Validating a path prefix using `starts_with` without first canonicalizing it can allow path traversal bypassing authorization checks. Because `starts_with` only performs a lexical comparison, an attacker can use dot-dot-slash (`../`) sequences to step out of the allowed directory (e.g., `/allowed/dir/../../etc/passwd` starts with `/allowed/dir`). Call `.cano

This rule detects Authlib's internal pattern before CVE-2026-28490 was fixed, where an algorithm is retrieved from a registry without validating whether it is deprecated when an explicit whitelist config is missing. This allowed insecure algorithms like RSA1_5 and 'none' to be used by default.

Constructing an `afero.NewBasePathFs` by taking `filepath.Dir` of a known directory path exposes the parent directory and its contents, causing potential path traversal and unauthorized access to sibling directories. Use `filepath.Clean` instead if the goal is to restrict access to the shared directory itself.

Detected an unsafe subtraction calculating multipart data length using `boundary.len + 8`. This calculation fails to align with the multipart buffer validation check that enforces a minimum length of `boundary.len + 6`. When the buffer length falls between these two values, it causes an integer underflow that generates a massive length parameter. This leads

Creating a temporary file without specifying a `dir` and then moving it with `shutil.move` can lead to an arbitrary file overwrite. If the temporary directory is on a different filesystem than the destination, `shutil.move` falls back to a copy operation, which insecurely follows symbolic links at the destination path. Provide the `dir` argument so the tempo

Sensitive Control Panel configurations like CP URLs and announcements are being exposed unconditionally inside an AssetBundle. This allows unauthenticated users to access administrative details. Guard these properties using `$request->getIsCpRequest()`.

Mass assignment of user-supplied criteria to a database query object through `Craft::configure()` without unsetting SQL-specific keys allows SQL injection. Attackers can overwrite query properties (like 'where', 'join') to inject arbitrary SQL logic. Ensure you sanitize the criteria array by unsetting unsupported keys (e.g., `where`, `orderBy`) before passin

Concurrent modification of a receiver's map or fields in an HTTP handler without synchronization is unsafe. In Go, concurrent map writes cause a fatal runtime panic (fatal error: concurrent map writes), leading to process termination and Denial of Service (DoS). Protect shared state with a synchronization primitive like `sync.Mutex` or `sync.RWMutex`.

When disabling guest access permissions, the `Kill` permission is not explicitly revoked. This allows unauthenticated users to interact with endpoints that require `Kill` authorization, leading to broken access control and potential Denial of Service.

Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with

Decoding a request path or URL using `decodeURIComponent` can introduce a path confusion vulnerability. `decodeURIComponent` decodes percent-encoded slashes (`%2F`) into literal slashes (`/`), whereas most application routers use `decodeURI`, which leaves them encoded. This discrepancy can allow an attacker to bypass route-based middleware protections (e.g.,

Direct creation of child contexts via the stream read context bypasses maximum nesting depth validation defined in `StreamReadConstraints`. This can lead to uncontrolled resource consumption and a StackOverflowError or Denial of Service (DoS) when deeply nested documents are parsed. Delegate these operations to `createChildArrayContext` and `createChildObjec

Dictionary keys passed directly to `ChildQuery` without prior validation. An attacker can pass malicious SQL fragments or uppercase SQL function names as dictionary keys in the `fields` parameter to achieve SQL injection. Validate the keys (e.g., ensuring they are not uppercase) before passing them to the query builder.

The sensitive `workerConfig` object is used statically outside of Next.js server-side rendering bounds (e.g., getServerSideProps). In Next.js, referencing it at the component or shared layout layer embeds these secrets directly within the static client JS bundle.

Double placeholder expansion in Caddy HTTP vars matcher exposes a vulnerability where untrusted user input within a placeholder can be double-evaluated. This can lead to a leak of environment variables, files, or sensitive server info. Ensure placeholders are handled safely by preventing double repl.ReplaceAll() calls on request controlled keys.

Sandbox execution via the manager interface lacks input validation, allowing malicious scripts or arguments to bypass security controls and reach the underlying executor. Ensure custom validation is implemented before passing execution payload to the sandbox.

A custom fallback file resolution method yields filepaths without bounds validation, which can allow path traversal.

Detected potential Path Traversal. Unsanitized inputs generated by `path.join` are being supplied directly into file reading API(s) such as `fs.readFileSync`. Attackers may be able to read restricted system files by injecting traversal sequences (`../`). Ensure that all dynamic paths are sanitized via a proper validation routine before they are read.

Extracting a destination URL from the request path via regular expressions and directly passing it to `fetch` enables Server-Side Request Forgery (SSRF). This approach is additionally vulnerable to WAF/Edge bypasses via path normalization differences (such as using backslashes). Validate and allowlist the extracted destination before making request calls.

Decoding an HTTP request body into memory without constraints can lead to Denial of Service (DoS) by memory exhaustion. An attacker can send an arbitrarily large request payload. Ensure that the request body size is limited either globally using `http.MaxBytesHandler` (checked via `MaxBytesError`), or locally using `http.MaxBytesReader` or `io.LimitReader`.

Processing a block header without checking the remaining size can lead to a size variable underflow. This underflow can cause massive loops over out-of-bounds memory reads and writes. Validate size before subtraction.

A multipart payload is split into parts and iterated over without checking the maximum number of parts. If an attacker submits a highly segmented payload, this synchronous iteration can consume excessive CPU time and lead to a Denial of Service (DoS) by blocking the event loop. Enforce a limit on the length of the parts list via `len()` before iterating over

Missing escaping of square brackets in shell execution context, allowing glob expansion bypass.

Detected potentially insufficient escaping of system inputs. First, custom sanitization using `re.sub` character classes may miss critical shell characters (like semicolons or newlines) when used to build terminal strings or HTML. Second, directly rendering `json.dumps` to variables intended for HTML can lead to Cross-Site Scripting (XSS), as `json.dumps` do

The OIDC/OAuth2 token endpoint processes an "authorization_code" exchange but appears to perform the code lookup without including the requesting Client ID validation. An attacker could use their own valid client credentials to exchange an authorization code that was meant for another client, leading to unauthorized token issuance. Ensure you verify the requ

Incorrect size calculation for strncat/g_strncat. Subtracting the length of the source string from the total size rather than the length of the destination buffer fails to account for data already accumulated in the destination. This can lead to a heap-based buffer overflow. Calculate the remaining size using the destination string length (e.g., size - 1 - s

A source path extracted from user input via an untrusted map is passed directly to a file operation or import function without validation. This can result in path traversal, arbitrary file read, or exposing sensitive local files. Validate the file path against specific allowed subdirectories and block sensitive paths.

Path variables from an HTTP request are passed to a validation or authorization function before being normalized with `path.Clean()`. An attacker can bypass deny rules by using `../` traversal sequences, which are then normalized after the validation checks. To fix this, always call `path.Clean()` on the input paths before evaluating them against security ru

Missing 'Download' permission check when verifying 'Share' permission, allowing users to bypass download restrictions via public share links.

A user-supplied URL is passed directly into `file_get_contents()`. Validating user input with only `FILTER_VALIDATE_URL` is insufficient because it does not restrict dangerous protocol schemes (such as `file://`) and does not prevent hostname resolution to private or internal IP ranges. This combination leads natively to Server-Side Request Forgery (SSRF) an

Unpacking multiple logical parameters from a single Gin path variable using `strings.Split` can lead to parameter confusion and input validation boundaries bypass. If a user-controlled item (like an ID) naturally contains the delimiter, subsequent array offsets map incorrectly, potentially leading to logic corruption, IDOR, or errors. To resolve this securel

Using `fs::metadata()` instead of `fs::symlink_metadata()` to inspect a path following a directory creation error allows attackers to bypass boundary checks using symlinks. `fs::metadata()` follows symbolic links, meaning if an attacker creates a symlink where a directory is expected, the application will evaluate the target of the symlink. Use `fs::symlink_

Passing unsanitized user-supplied criteria to `Craft::configure()` on a query object can allow SQL injection if the keys include query properties like 'where', 'select', 'join', etc. Always remove unsupported or dangerous keys from user-supplied criteria before passing them to configuration functions.

Unrestricted mass assignment of user input to an object via `Craft::configure()`. Applying untested user input (such as data from `Component::cleanseConfig()`) directly to a database query object allows attackers to set arbitrary query properties such as 'where', 'join', or 'union', leading to arbitrary SQL injection. Ensure sensitive query attributes are ex

Directly configuring objects using request data (via Component::cleanseConfig) without filtering out restricted SQL criteria properties (e.g., 'where', 'union') exposes the application to SQL Injection. Ensure that unsafe array keys are unset before applying the criteria.

Archive extraction via `tarfile.extractall` iterates over members and attempts safety validation but misses symlink target validation. This allows a bypass via malicious symbolic links pointing outside the extraction directory. Verify all members using `issym()` and `islnk()`.

Missing validation of git remote URL allows local path cloning.

Incomplete path traversal guard. The software validates only one path component for directory traversal sequences ('..') while missing other concatenated user inputs.

The code assigns `True` to an ORM query clause when a parameter equals "all", effectively bypassing record-specific filtering. If not properly guarded by an authorization check verifying the user has global read access, this allows attackers to access restricted records. Validate user permissions or filter against an explicit list of allowed records instead

The application blindly trusts the `X-Forwarded-Proto` header to dictate the URL scheme without verifying whether the originating proxy is trusted. This allows an attacker to spoof the protocol (e.g., impersonating an HTTPS request over HTTP) and potentially bypass scheme-based access control rules. Ensure that `X-Forwarded-*` headers are only used when they

A wildcard `*` is hardcoded as the value for the `Access-Control-Allow-Origin` header in `send_header`. This permissive CORS policy allows any origin to read the response. If the HTTP server exposes sensitive data or APIs, this can result in cross-origin data exfiltration via simple requests or preflight bypasses. Configure allowed origins explicitly instead

Inappropriate application of `HTMLEscapeString` on string inputs prior to Markdown conversion. This causes valid HTML sequences to be redundantly double-escaped because the `goldmark` converter natively handles rendering. Pass the string directly to the Markdown converter without prior escaping.