GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
2 rules matched. Showing 2 loaded rules.
Publish rule
CVE-2026-115727: Python Flask Werkzeug Debug Enabled Rcecve-2026-115727-python-flask-werkzeug-debug-enabled-rce

The development server is started with the interactive Werkzeug debugger enabled (debug=True / use_debugger=True / evalex=True). Flask wraps the WSGI app in DebuggedApplication, which serves an evalex Python console on every unhandled traceback and at /console. The debugger PIN is derived from machine-local, guessable values (username, flask module path, NIC

PythonFlaskCVE-2026-115727CWE-16CWE-489CWE-94
by Provallyupdated 2026-10-27Apache-2.0
540 direct54 via packs
81
CVE-2026-42302: Code Server Auth None Unauthenticated Rcecve-2026-42302-code-server-auth-none-unauthenticated-rce

code-server is started with '--auth none', completely disabling all authentication. Any user with network access to the bound port can open the VS Code IDE without credentials and execute arbitrary commands inside the container (CVE-2026-42302 / CWE-306). Replace '--auth none' with '--auth password' or '--auth cookie', and bind to 127.0.0.1 rather than 0.0.0

BashCVE-2026-42302GHSA-34RC-438G-7W78CWE-16CWE-306
by Provallyupdated 2026-06-12Apache-2.0
3.7K0 direct3.7K via packs
77
All matching rules loaded.