Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Directly reading the Kubernetes ServiceAccount token from '/var/run/secrets/kubernetes.io/serviceaccount/token' can expose cluster credentials if the token is transmitted in outbound requests. Use a scoped token with a restricted audience instead.
ARM CMSE non-secure callable entry function receives pointer '$PTR' from untrusted Non-Secure world without verifying memory attribution via cmse_check_address_range() or equivalent validation. This allows Non-Secure callers to pass pointers targeting Secure memory.
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
`apply_constraints` for doubly-nested arrays delegates directly to `map_while_ok` without validating outer array constraints (such as min_length, max_length, or nil_items?) or verifying that the outer term is a list.
Interpolating raw submitted parameters into exception messages leaks sensitive fields into crash reports and logs, bypassing Phoenix parameter filtering.
Formatting git log output as raw XML tags with git placeholders and parsing it with SimpleXMLElement can lead to denial of service or parsing failures if commit messages or metadata contain XML special characters or CDATA delimiters.
Publish access check queries disabled publish access without also verifying invisible publish access, allowing unlisted/invisible content to be enumerated.
Directly converting decrypted token strings to integers using intval() without validating that the plaintext strictly contains digits allows forged or spliced CBC ciphertexts to bypass authentication/authorization checks.
Raw exception messages or inspected objects are serialized directly into a JSON error response. This may expose internal system information, database queries, or schema details to end users. Consider formatting or sanitizing the error first.
Calling `constructor.isBuffer(...)` without checking `typeof ... === 'function'` can throw an unhandled TypeError if an object with a non-callable `constructor.isBuffer` property is provided.
File paths received from MCP tool arguments are resolved with filepath.Abs and used without sensitive path validation or boundary checks. This allows prompt-injection or untrusted inputs to exfiltrate sensitive local files.
Calling `Email(email)` instantiates a WTForms validator object with the argument as its error message rather than executing field validation. To validate a field manually, instantiate and call the validator with the form and field objects: `Email()(form, form.email)`.
Sensitive credentials or authentication requests are transmitted to a caller-supplied server URL without validating that HTTPS is enforced and the target host is on an allowlist of configured servers.
Pandoc is invoked with a TeX/LaTeX PDF engine without explicitly disabling shell escape via '--pdf-engine-opt=-no-shell-escape'. Untrusted input containing TeX commands or LaTeX macros could execute arbitrary commands or read sensitive local files during PDF compilation.
MongoDB Collection constructor does not validate namespace identifiers against null bytes. Namespace identifiers containing null bytes can cause database operations to be redirected to unintended collections.
Database names must be validated with _mongoc_validate_db_name before assembling commands or formatting namespaces to prevent namespace injection.
The collection rename operation does not validate the target collection name before proceeding. Unvalidated namespace identifiers containing embedded null bytes or separator characters can lead to namespace confusion and unauthorized cross-tenant data access.
Bulk write operations on ClientBulkWrite structs do not validate that database names are free of '.' characters. MongoDB server splits namespaces on the first period, so unvalidated database names containing '.' can retarget writes to unintended databases and collections.
Plaintext action argument inherits sensitivity from source attribute instead of enforcing `sensitive?: true`, risking cleartext exposure in logs, inspect dumps, and error reports.
HTTP redirect handler modifies request headers during redirects but does not check for or reject HTTPS-to-HTTP scheme downgrades, potentially exposing sensitive headers over plaintext HTTP.
Exposing pprof debug routes directly on a router without authentication or conditional checks may allow unauthorized actors to access sensitive profiling data such as process command-line arguments, environment variables, or memory dumps.
The redirect URL validation only compares URL scheme and host without validating the path component. An attacker could supply an arbitrary path on an allowed domain to capture OAuth codes or tokens via Referer headers, analytics scripts, or open redirects. Validate the full path or require exact URL matches.
`SubmoduleConfigParser` is instantiated without `merge_includes=False`. This allows untrusted `.gitmodules` files to execute `[include]` directives and read arbitrary local files on the system.
Raw API token or secret is embedded directly into a dictionary passed to template rendering instead of using an opaque handle or hashed identifier.
