Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Organization-scoped route is protected by JwtAuthGuard but lacks OrganizationValidateGuard, allowing authenticated cross-tenant access to organization resources.
IAM policy inspection only checks standalone 'aws:iam/policy:Policy' resources, ignoring inline policies (RolePolicy, UserPolicy, GroupPolicy) and policy attachments. This allows administrator or unsafe policy definitions to bypass security guardrails.
Envelope permission checks validate rejected and completed states but omit validation for the cancelled status, potentially allowing modification of cancelled envelopes.
Route handler parameter `$AUTH` is obtained via `Depends(...)` but is never referenced in the handler body when accessing conversation management services. This indicates a broken object-level authorization (BOLA/IDOR) vulnerability where conversation operations are performed without user ownership validation.
REST endpoint performs entity removal or retrieval without verifying that the target entity's realm is accessible to the authenticated context.
HTTP handler serves local MCP/RPC transport requests without validating the Host header against DNS rebinding attacks on loopback connections.
Detected non-raising 'Ecto.Adapters.SQL.query' call executing an 'ALTER SCHEMA' DDL statement without validating the return value. If PostgreSQL rejects the schema operation (e.g. name collision), the failure may be silently ignored. Use 'Ecto.Adapters.SQL.query!' or explicitly handle the '{:ok, _} | {:error, _}' result tuple.
Broad HAProxy access rule permits requests to `/containers` without restricting sensitive sub-endpoints like `/archive`, `/export`, and `/logs`, exposing container filesystems and logs.
A subsequent call to `Auth::routes()` without `'register' => false` re-enables public user registration routes that were previously disabled, potentially allowing unauthenticated registration with default roles.
Chaining `where()` conditions directly with `orWhere()` at the top query level causes logical operator precedence issues (`WHERE A AND B OR C` evaluates to `(A AND B) OR C`), which can bypass preceding tenant or authorization filters. Group OR conditions inside a `where(function ($query) { ... })` closure instead.
Chaining `orWhere` at the top level of a query that uses tenant scoping (`where('company_id', ...)`) can bypass multi-tenant isolation due to SQL operator precedence (AND before OR). Group OR conditions inside a closure `->where(function ($query) { ... })` instead.
A pre-process or filter event is dispatched inline with `new` without capturing the event instance or the return value of `dispatch()`. Event listeners modifying request parameters, arguments, or enforcing access control will have their changes discarded.
MCP stdio server spawned without staged root hash verification and authority validation.
Access control decisions or path checks should not use `HttpServletRequest.getRequestURI()` with substring or prefix matching methods like `contains()`, `startsWith()`, or `endsWith()`. Raw request URIs may include matrix parameters, path traversal tokens, or unnormalized prefixes that allow authentication and authorization bypass. Use container-normalized m
Demo project generation directly modifies the local workspace prior to server startup, bypassing configured authentication secrets. Use RemoteWorkspace or authenticated service endpoints to initialize projects.
Exposure of dangerous configuration parameters or raw SQL execution in AI assistant system prompts
Restoring settings into freepbx_settings without filtering or validating the AUTHTYPE setting can allow an attacker to disable authentication (AUTHTYPE=none).
The controller checks if a label is already present on a user-controlled resource (`$OBJ.Labels`) before applying inherited or mandatory controller labels. An attacker can supply pre-existing labels to bypass controller label assignments and gain unauthorized access or join arbitrary sets.
The JWT 'sub' (subject) claim is assigned a static string literal rather than a dynamic user identifier. This misconfiguration causes all issued tokens to share the same subject identity, potentially leading to privilege escalation or authorization bypasses.
The JWT 'sub' (subject) claim is set to a static identifier or string literal instead of a dynamic user identifier. Hardcoding the subject claim causes all generated tokens to share the same identity, breaking user isolation and authorization boundaries.
The JWT 'sub' (subject) claim is assigned a hardcoded string literal instead of a dynamic user identifier. In JWT specifications (RFC 7519), the 'sub' claim identifies the principal subject of the token. Hardcoding this value causes all issued tokens to share an identical subject claim, which can allow anonymous or unprivileged users to bypass access control
Permitting `:account_id` in Rails strong parameters allows user-controlled mass assignment of tenant association, which can lead to cross-account authorization bypass and resource takeover.
Nested serializer input is resolved using an unrestricted model queryset (.objects.all()) without applying user permission restrictions. Authenticated users may exploit this to perform ORM lookup injection and access unauthorized objects.
User-supplied array parameters from req.body are passed directly into event emissions or scope operations without prior database querying and filtering to ensure ownership within the target scope.
