Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Deserialization filter configuration is loaded directly via ClassLoader.getResources() instead of aggregated metadata discovery. In single or shaded JAR environments, this causes configuration file collisions and omissions, leading to missing deserialization filters.
Outdated third-party dependencies detected; update dependencies in go.mod/go.sum.
Vendored copy of zlib at version older than 1.3.2 detected. Versions <= 1.3.1 contain multiple security defects identified by the 7ASecurity audit (CVE-2026-27171, CVE-2026-3381 / CVE-2026-4176 in Perl's Compress::Raw::Zlib): missing NULL/zero-length guard in compress2(), non-thread-safe custom once() pattern in crc32 table init, and size_t-overflow risk in
Bundled libxslt version prior to 1.1.43 is vulnerable to use-after-free issues (CVE-2025-71406).
Apache Shiro is pinned to a version prior to 1.5.3 in this pom.xml. Versions 1.0.0-incubating through 1.5.2 are affected by an authentication bypass (CVE-2020-1957 and related, including the class of bug behind CVE-2025-45611 in hope-boot) caused by a path-normalization discrepancy between Shiro's filter chain and Spring MVC. An unauthenticated attacker can
Bundled libxml2 version 2.10.3 is vulnerable to NULL pointer dereference (CVE-2023-54354 / CVE-2023-28484). Upgrade to 2.10.4 or newer.
Vendored libxml2 version is vulnerable to CVE-2022-23308 and should be upgraded.
Bundled libxml2 in dependencies.yml is vulnerable to CVE-2022-40303 and CVE-2022-40304. Upgrade libxml2 to version 2.10.3 or higher.
Bundled libxml2 version is vulnerable to multiple CVEs (CVE-2021-47996). Upgrade to 2.9.12 or newer.
