Rule Explorer

Whitelisted HTTP endpoint $FUNC resolves a CRM record from the caller-controlled parameter $PARAM via $LOOKUP and returns the match without enforcing document read permissions. The lookup runs raw query-builder queries that bypass the Frappe permission engine, and @frappe.whitelist() only requires authentication, so any authenticated user can enumerate Leads

PythonCVE-2026-116492CWE-862

Pydantic request model $MODEL declares range-geometry fields (offset / start / index / position, length / size) as plain `int` with no `Field(ge=...)` / `Field(gt=...)` constraint. When this schema validates remote request bodies, a client can supply negative offsets or zero/negative lengths that slip past downstream arithmetic bounds checks (Python negative

PythonCVE-2026-116178CWE-1284CWE-20

Pillow's decompression-bomb guard is globally disabled by assigning None to Image.MAX_IMAGE_PIXELS. This mutates process-wide PIL state (typically as a module-import side effect), so every later decode of untrusted image bytes -- e.g. Image.open(<request bytes>).load() on media submitted to an API endpoint -- allocates the full raster declared in the image h

PythonCVE-2026-116177CWE-400CWE-770

Unbounded audio decode at the untrusted-media ingestion boundary: $FUNC is called inside a MediaIO subclass (the layer that converts attacker-controlled request media, e.g. base64 input_audio or audio_url, into in-memory arrays) with max_duration_s unset (defaults to None = unlimited) or explicitly None. A small compressed payload can expand into gigabytes o

PythonCVE-2026-116175CWE-400CWE-409CWE-770

An encryption key is derived from a secret with a single fast, unsalted hash ($HASH) and the digest is fed straight into a symmetric cipher to encrypt data. Ciphertext produced this way can be brute-forced fully offline at GPU speed (no per-ciphertext KDF work and no salt, so precomputed tables and cross-backup key reuse apply), which exposes every password-

PythonCVE-2026-116071CWE-327CWE-916

A model/asset name read from caller-supplied $KWARGS is interpolated into a downloaded asset's URL/filename and fetched with no integrity check (hash argument is None). A crafted name can carry path-traversal ("../") and URL-fragment ("#") syntax that steers the local write path and the fetched URL independently, letting an unauthenticated caller plant attac

PythonCVE-2026-115924GHSA-QR6X-7V33-6QMGGHSA-qr6x-7v33-6qmgCWE-20

Multimodal input validator rejects a present tensor because its reduced pixel sum is zero ($COND). Normalized image pixels can legitimately sum to exactly 0 (e.g. an image that is half black and half white under Normalize(0.5, 0.5)), so this shortcut discards a legal input, makes embed_multimodal() return no embeddings for an encoder step that still carries

PythonPyTorchCVE-2026-115914CWE-20CWE-400CWE-617

An attention probability tensor (the softmax output over the O(T^2) score positions) computed during a forward pass is stored on the module itself (`self.$ATTR = ...`). nn.Module instances are long-lived and are shared across requests in an inference server, so this input-sized tensor is retained after the request finishes and sits outside per-request memory

PythonPyTorchCVE-2026-115913CWE-400CWE-401

Bytes read from shared memory at an externally supplied handle (address/monotonic_id) are passed to deserialization without verifying an authenticated signature for the handle. A caller who controls the handle can point the reader at attacker-chosen bytes inside the shared segment; those bytes reach deserialize()/pickle.loads() and give arbitrary Python code

PythonCVE-2026-115912CWE-502CWE-639

OIDC nonce validation passes whenever *some* stored nonce record exists: the token's `nonce` claim is looked up in shared nonce storage ($NONCE_OBJ = $STORE.get_nonce($NONCE)) and accepted on mere existence (`if $NONCE_OBJ:`). The presented nonce is never compared against the nonce bound to the browser session / authorization state that initiated this login,

PythonCVE-2026-115910CWE-287CWE-294

This HTTP header-value screen rejects NUL bytes but accepts bare CR or LF bytes in $DATA. A parser that splits header lines only on CRLF keeps a bare CR/LF inside the value, while lenient front-end proxies treat that byte as a line terminator; the framing disagreement lets a hidden header such as Content-Length stay folded into the value and smuggle or re-fr

PythonCVE-2026-115877CWE-20CWE-436CWE-444

Outbound HTTP request made with the raw requests library using a URL derived from externally supplied data (parsed import document or a URL field read out of a data structure). This bypasses the application's centralized SSRF-hardened request wrapper, letting an authenticated attacker force the server to issue requests to arbitrary internal or external hosts

PythonCVE-2026-115810CWE-918

$FUNC appends network-received data to the per-connection buffer self.$BUF without any length cap. A peer can withhold the protocol end-of-record terminator (e.g. Telnet IAC SE) while continuing to send bytes, so the persistent buffer grows without bound across receive calls and exhausts process memory, terminating every service hosted in the process. Cap th

PythonCVE-2026-115778CWE-400CWE-770

$C.dataReceived retains the unterminated tail of received network data in a persistent buffer ($BUF = $LINES.pop()) with no maximum line length, so a remote peer that never sends the line delimiter grows the per-connection buffer without bound, exhausting memory/CPU of the shared process before any authentication (remote unauthenticated denial of service). B

PythonCVE-2026-115776CWE-400CWE-770

The development server is started with the interactive Werkzeug debugger enabled (debug=True / use_debugger=True / evalex=True). Flask wraps the WSGI app in DebuggedApplication, which serves an evalex Python console on every unhandled traceback and at /console. The debugger PIN is derived from machine-local, guessable values (username, flask module path, NIC

PythonFlaskCVE-2026-115727CWE-16CWE-489CWE-94

A count parsed from the attacker-supplied stream ($SIZE, read straight from a raw parse call such as read_object) is used directly as the bound of the `while $CNT < $SIZE` entry-parsing loop without being validated against the actual size of the stream. A crafted file can declare a subsection count far larger than the file can hold (a valid xref entry is 20

PythonCVE-2026-115580CWE-400CWE-834

Unconfined path construction before a file read: a dynamic path segment $COMP is joined onto a base directory with os.path.join() and the result is opened without os.path.realpath() canonicalization and without a containment check. os.path.join() silently discards the base directory when $COMP is absolute, and os.path.normpath() only collapses ".." segments

PythonCVE-2026-115354CWE-22CWE-23CWE-36

Path traversal (CWE-22): a file path is built with os.path.join($BASE, $P) and passed to open() without proving the resolved target stays inside $BASE. os.path.join silently discards $BASE when $P is absolute, and os.path.normpath only collapses "../" lexically, so an attacker-controlled $P can read any file readable by the process. Reject absolute arguments

PythonCVE-2026-115353CWE-22CWE-23CWE-73

get_object() in class $VIEW fetches the object with `self.queryset.get(...)` (the raw class-level queryset attribute) instead of `self.get_queryset()`. This bypasses the queryset hook where tenant/organization scoping and filter_queryset() are applied, and — because get_object() is overridden — DRF's default check_object_permissions() never runs. Any authent

PythonDjangoCVE-2026-115329CWE-285CWE-639

SQL is assembled by interpolating data ($X) directly inside single-quoted SQL string literals and executed via the Databricks statement-execution API without bind parameters. A crafted memory text, metadata value, or record ID containing a single quote terminates the SQL literal and injects arbitrary SQL (CWE-89): a tautology WHERE clause such as "' OR '1'='

PythonCVE-2026-115324CWE-89

Collected pypika filter criteria are rendered to a raw SQL text fragment with $CRITERION.get_sql(with_namespace=True, quote_char=...) and interpolated into the engine's WHERE clause. pypika's ValueWrapper only escapes quote characters, not backslashes, and MariaDB treats '\' as an escape character inside single-quoted string literals, so a user-controlled fi

PythonCVE-2026-114664CWE-89

JWT audience ('aud') claim validation is enforced only when the configured audience list is non-empty. When the list is empty the 'aud' claim options keep presence-only semantics, so a correctly signed assertion minted for another service (different audience) is accepted and can be exchanged for an access token across a trust boundary (RFC 7523 section 3). F

PythonCVE-2026-114618CWE-1188CWE-287

Key-material validator $CHECK_KEY() rejects malformed key formats (key material containing unsafe PEM/SSH markers) but never rejects empty key material. HMAC with a zero-length key is deterministic and publicly computable, so a secret that resolves to "" or b"" (missing/unset configuration, a JWK {"kty":"oct","k":""}, or a key callable returning "") lets an

PythonCVE-2026-114616CWE-1284CWE-20

Incomplete key-material safety guard: `$KEY.startswith($MARKERS)` rejects asymmetric key markers only at byte 0, while PEM/SSH parsers accept leading whitespace, comment lines, or a UTF-8 BOM before the "-----BEGIN" block. Key bytes carrying such a prefix pass this deny-check and can later be imported as a symmetric (HMAC) key secret, so anyone who knows the

PythonCVE-2026-114615CWE-20CWE-347