Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A value parsed by std::stoi()/std::stol()/std::stoll() with base 16 is used as an array or container index without validating the parsed characters with std::isxdigit. Base-16 std::stoi() accepts a leading '-' sign and throws std::invalid_argument on non-hex characters, so attacker-controlled text shaped like "<0xXX>" but containing a sign or non-hex charact
Unhandled Err from $TIME.duration_since($EPOCH): duration_since() returns Err(SystemTimeError) whenever the timestamp precedes 1970-01-01, so the .unwrap()/.expect() here panics on pre-epoch (negative-seconds) values. If the timestamp is attacker-influenced (e.g. a guest-supplied file time later applied with futimens/utimensat), the panic escapes the host-ca
This zlib decompression stream ($STREAM) is created but never given an "error" listener before being fed compressed data. zlib emits "error" asynchronously on a later tick (e.g. Z_DATA_ERROR on malformed DEFLATE bytes, or the maxOutputLength cap being exceeded); per Node.js EventEmitter semantics an "error" event with zero listeners is thrown, and because it
EventEmitter#removeAllListeners() also removes the 'error' handler. If this emitter (e.g. a parsing stream) can still emit afterwards — because a deferred callback resumes it or its finalization completes asynchronously — Node raises an unhandled 'error' event, which is thrown as an uncaught exception and terminates the whole process (a single request can cr
A request stream is piped into a zlib/brotli/zstd decompression stream that never gets an 'error' listener and is never detached/destroyed after the body is read. Trailing bytes appended after one complete compressed frame reach the already-finished decoder and emit an 'error' with no listener, which Node re-throws as an uncaught exception and kills the proc
Transaction deserialization via zcash_primitives Transaction::read accepts wire bytes selected by nConsensusBranchId without validating that the parsed transaction version is compatible with that branch ID. A transaction version introduced at a later network upgrade (e.g. V6 at NU6.3) parsed with an older/unmapped branch ID can select bundle encodings the co
A field of a record decoded from the untrusted pack stream (e.g. an entry's running pack_offset) is fed to checked_sub() together with a plain parsed value (e.g. the OFS_DELTA base_distance varint read from a served thin pack), and the None case is escalated into a process-aborting panic with expect()/unwrap() instead of being validated against a boundary (b
`$VAL.to_str()` is unwrapped with a panicking combinator, asserting that the header value is entirely visible ASCII. HTTP header values are opaque bytes (RFC 9110): `HeaderValue::from_bytes` accepts non-ASCII bytes (0x80-0xFF) that `to_str()` rejects, and values pulled from a fetched response's HeaderMap (or stored from script input via `from_bytes`) carry w
CBC decryption via cipher.NewCBCDecrypter(...).CryptBlocks(...) is performed without checking that the initialization vector length equals the cipher block size and that the ciphertext length is a multiple of the block size. Go's crypto/cipher panics on either violation ("IV length must equal block size" / "input not full blocks"), so attacker-controlled doc
A length-delimited wire field (1-byte length prefix, max 255 raw bytes) is decoded with new String(bytes, UTF_8) and returned without re-validating its encoded length. Java's UTF-8 decoder uses REPLACE semantics, so every malformed byte sequence becomes U+FFFD, which is 3 bytes when re-encoded; a 255-byte malformed value can therefore re-encode to ~765 bytes
The JWK-shape guard around raw key material parses the key with json.loads but only catches ValueError. Any other parse failure (e.g. RecursionError on deeply nested JSON, or un-normalized Unicode byte-order marks / alternate encodings that fail to decode) escapes the guard, so JWK-shaped key material is never rejected and falls through to be used directly a
The sandbox->host Proxy apply trap hands a host function's return value to the sandbox via thisFromOther($RET) without first marking the value as handled at the boundary. When a host function returns a rejected host-realm Promise (an embedder async function, Promise.reject, events.once, ...) and sandbox code ignores the result (no .then/.catch/.finally), the
$FUNC terminates the whole process with exit($STATUS) when it rejects bytes deserialized from an in-memory payload (fmemopen'd buffer / FILE* stream). In a Redis module this code is reachable with attacker-controlled bytes via module commands (e.g. GRAPH.EFFECT), so one malformed payload kills the server instead of reporting an error; after a supervised rest
removeAllListeners() detaches every listener from this stream, including the 'error' listener, while the stream itself is left running. If the stream still holds buffered input (or receives more bytes from a remote peer) it can emit 'error' with no listener attached; Node.js escalates an 'error' event with no listener into an uncaught exception and terminate
abort() is called on a WHATWG WritableStream ($WS) and the returned promise is discarded. Per the WHATWG Streams standard, WritableStream.abort() returns a promise that rejects with a TypeError whenever the stream is locked by a writer (writable.getWriter(), the only way applications can write). Discarding that rejection produces an unhandled promise rejecti
Goroutine executed via errgroup.Group.Go without panic recovery. Panics occurring in child goroutines bypass top-level HTTP recovery middleware and terminate the entire server process, leading to Denial of Service.
A value derived from client-supplied GraphQL resolution arguments is passed to Map.fetch!/2, which raises an unhandled KeyError when the key is absent (e.g. a forged relay/global id whose type segment is not an exposed type). The exception escapes the resolver before any delegated resolve/2 rescue handler runs, so the client gets a 500 and possibly a stacktr
Calls to squashfs.Read on potentially untrusted squashfs images without panic recovery can cause a denial of service if malformed image headers trigger runtime panics in go-diskfs.
Dynamic regular expression compilation with 'qr/$var/' without an enclosing 'eval' block can throw a fatal exception if the variable contains invalid regex syntax, causing a denial of service.
A length prefix is read from an untrusted byte stream with encoding/binary.Read into a signed integer and passed to make() without checking that it is non-negative. Attacker controlled bytes with the sign bit set (e.g. 0xFFFFFFFF) decode to a negative int (e.g. -1), and make() panics with "len out of range". The panic is unrecovered on the network reader gor
The peer-supplied protocol payload `$P` is sliced/indexed at a fixed offset ($K) without validating its length. The peer controls the payload size, so a malformed or truncated message makes this expression panic with "slice bounds out of range"; when it runs in a goroutine without a recover(), the whole process terminates (CVE-2026-77375: an authenticated SS
An attacker-controlled field name ($NAME) received from a form/multipart event handler is passed to an append-style helper ($APPEND) without any exception handling. Helpers with this API parse bracketed keys (e.g. "items[4294967294]") into object paths and array indexes, and a crafted name pair can make the call throw synchronously (RangeError: Invalid array
Infallible `From` conversion from a date/time type `$IN` into `$OUT` panics on a fallible date/time conversion: `.expect()`/`.unwrap()` aborts the entire process when the underlying conversion fails for an out-of-range input (e.g. a timestamp outside the supported range, such as a pre-1970 signing time taken from an unauthenticated timestamp token). A `From`
Synchronous `throw` of a connection error inside createConnection() of an http(s).Agent subclass. Node calls agent.createConnection() synchronously from the ClientRequest constructor (agent.addRequest -> createSocket -> createConnection) without a try/catch and expects connection failures to be reported asynchronously: by returning a socket that emits 'error
