GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-116825: Services Httpsignatureservice Php Cwe 918 Cve 2026 116825cve-2026-116825-services-httpsignatureservice-php-cwe-918-cve-2026-116825

This function verifies an inbound HTTP request signature with openssl_verify() but accepts the request without any anti-replay control: the signed Date header is never checked against the server clock and accepted signatures are never recorded. A captured, validly signed request (for example an ActivityPub inbox POST performing Delete, Update, Follow or Undo

PHPCVE-2026-116825GHSA-7M9J-H553-397XCWE-294CWE-918
by Provallyupdated 2026-10-27Apache-2.0
440 direct44 via packs
87
All matching rules loaded.