GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
2917
Downloads
3.3M
Verified
2917
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
2 rules matched. Showing 2 loaded rules.
Publish rule
CVE-2026-33877: Password Reset Timing Side Channel User Enumerationcve-2026-33877-password-reset-timing-side-channel-user-enumeration

The password reset / account recovery handler awaits an artificial delay only on the "user not found" / "no email" branches and returns early, while the success path (email sent) returns without an equivalent delay. This timing differential is observable by an unauthenticated attacker and enables username/email enumeration (CWE-208 / CWE-204). Pad all branch

JSNode.jsCVE-2026-33877CWE-204CWE-208
by Provallyupdated 2026-06-12Apache-2.0
1.3K0 direct1.3K via packs
80
CVE-2024-28232: Username Enumeration Distinct Errorscve-2024-28232-username-enumeration-distinct-errors

Authentication endpoint returns different error messages depending on whether the user exists or the password is incorrect. This discrepancy allows attackers to enumerate valid usernames. To fix, return a generic error instead.

GoCVE-2024-28232CWE-204
by Provallyupdated 2026-06-12Apache-2.0
1.1K0 direct1.1K via packs
70
All matching rules loaded.