Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Defaulting the host binding address to '::' binds the server to all network interfaces, potentially exposing sensitive or unauthenticated endpoints to external network clients. Default to '127.0.0.1' or 'localhost' instead.
The plugin signature verification policy defaults or falls back to WARN instead of ENFORCE. This allows unsigned or unverifiable third-party plugins to be loaded and executed without cryptographic verification.
Insecure default exec configuration includes tailwindcss in execution whitelist.
Insecure classpath resource discovery for serialization filter configuration in fat JAR environments.
ClassLoader.getResources() used to discover Helidon serialization filter configurations may fail to aggregate metadata in single-jar or shaded packaging environments. Use MetadataDiscovery instead.
Standard ClassLoader.getResources lookup for serialization filter metadata may fail in single-jar or modular deployments.
Deserialization filter configuration files are loaded directly via ClassLoader.getResources(), which may fail to aggregate configuration across single/fat JAR packaging layouts, leading to unenforced filters.
A Django REST Framework `ModelSerializer` for an identity-related model overrides `create()` but does not explicitly set an unusable password. For models inheriting from `AbstractBaseUser`, the password field defaults to an insecure empty string, which may lead to authentication bypass if authentication backends fail to reject it. Explicitly set the password
The `allow_alternate_shell` configuration is initialized to true (1). This insecure default allows clients to supply arbitrary commands which are executed via /bin/sh without sanitization during RDP connection.
A single package string is used to initialize the type store, preventing the loading of additional security extension packages.
A gin Group has REST API handlers registered via `RegisterRoutesTo` without the `authenticate` middleware being applied to that group. When this group is mounted on the metrics/management gin engine (default TCP/9091), it exposes business endpoints (collection CRUD, credential management, search/query) without authentication — even when `common.security.auth
Unconfigured LDAP search base falls back to root naming context without logging or restriction. Searching the entire directory root DN for privileged objects like sudo roles allows any user with write access to any LDAP subtree to inject rules and elevate privileges.
The Uvicorn server is configured to bind to all network interfaces ('0.0.0.0' or '::'). This publicly exposes the service on all available interfaces by default. Bind to a loopback host (such as '127.0.0.1') or use a configurable environment variable instead.
Setting `ReadOnlyPort` to 0 in Kubelet configuration structs causes the field to be stripped during JSON serialization due to the upstream `omitempty` tag. As a result, kubelet ignores the 0 value and binds to the default unauthenticated port (10255), exposing sensitive cluster information. Set the read-only port dynamically via CLI flags (e.g., `--read-only
Allowing `ExceptionGroup` or `try/except*` (`TryStar` AST nodes) in an environment executing untrusted Python code exposes the application to a sandbox escape via a type confusion vulnerability in CPython < 3.13.2 (CVE-2025-22153). Disallow `ExceptionGroup` and `TryStar` nodes in restricted execution environments.
