GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
2 rules matched. Showing 2 loaded rules.
Publish rule
CVE-2026-114075: Triggerdev Uat Minted Without Source Pat Bindingcve-2026-114075-triggerdev-uat-minted-without-source-pat-binding

A delegated user-actor token (`tr_uat_` JWT) is minted without binding the id of the personal access token it derives from into the signed claims (`pat` claim). The token is stateless: with no `pat` claim the host cannot re-check the source PAT's liveness, so the delegated token survives revocation of its source PAT until expiry, and its capability cap canno

TSCVE-2026-114075CWE-285CWE-613CWE-918
by Provallyupdated 2026-10-27Apache-2.0
460 direct46 via packs
86
CVE-2026-11407: Php Twig Sandbox Policy Empty Method Property Checkcve-2026-11407-php-twig-sandbox-policy-empty-method-property-check

Twig sandbox SecurityPolicy callback implemented as a no-op. Twig calls checkMethodAllowed() before every method call and checkPropertyAllowed() before every property access inside a sandboxed template; an empty implementation lets templates invoke arbitrary methods and read arbitrary properties on any object reachable from the template context (e.g. object.

PHPCVE-2026-11407CWE-693CWE-749
by Provallyupdated 2026-10-27Apache-2.0
450 direct45 via packs
85
All matching rules loaded.