Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Schedule status is updated based on stream key lookup without verifying that the stream key belongs to the schedule or playlist owner. This can allow unauthorized users to modify or cancel scheduled broadcasts.
The Express application hosting Model Context Protocol (MCP) transports calls `app.listen()` without specifying an explicit host or bind address. In Express, omitting the host defaults to binding on all network interfaces (`0.0.0.0`), exposing MCP tools to any reachable network client. Explicitly bind to a loopback address (e.g., `127.0.0.1`) or enforce inbo
TelemetryHandler is registered or configured without basic authentication decoration, potentially exposing provider telemetry unauthenticated.
Exposing pprof debug routes directly on a router without authentication or conditional checks may allow unauthorized actors to access sensitive profiling data such as process command-line arguments, environment variables, or memory dumps.
Engagement metric endpoint (such as like, favorite, or vote) is registered without rate limiting, idempotency, or authentication middleware. Unrestricted repeated requests may lead to metric inflation and resource exhaustion.
A subsequent call to `Auth::routes()` without `'register' => false` re-enables public user registration routes that were previously disabled, potentially allowing unauthenticated registration with default roles.
The controller's editAction performs HMAC or token-based authorization, but updateAction persists updates to the repository without verifying the token or using a #[Validate] attribute.
Demo project generation directly modifies the local workspace prior to server startup, bypassing configured authentication secrets. Use RemoteWorkspace or authenticated service endpoints to initialize projects.
Hardcoding 'dangerouslyDisableDefaultAuthPolicy' or 'dangerouslyAllowOutsideDevelopment' to 'true' in Backstage configuration disables default authentication policy enforcement or permits guest access in non-development environments.
FastMCP server initialized without an `auth` provider parameter. Unauthenticated HTTP MCP endpoints allow remote callers to execute actions or retrieve sensitive device data.
FastAPI route endpoint is defined without authorization dependencies or token validation via Depends(). Ensure sensitive endpoints require authentication/authorization dependencies.
Missing authentication check
VM management actions are executed using ambient kubeconfig credentials without validating forwarded user credentials.
JWT authentication request is processed with password verification bypassed (`authenticate(..., true)`) without verifying whether JWT authentication is enabled in application configuration (`isJwt()`). This can lead to unauthorized authentication bypass.
An HTTP error status is set on the response, but execution is not halted. This causes a fall-through to the remaining code, potentially bypassing authorization or state checks. Use `return`, `raise`, or an `else` block to prevent unauthorized execution of sensitive logic.
Cluster heartbeat handler mutates node state or records heartbeat in registry without performing authentication validation.
Authentication middleware fails open and forwards requests when credential/password hash is None.
Webhook authentication is conditionally verified only when a secret is configured. If the secret is unset or empty, the verification is bypassed and unauthenticated requests are processed. Ensure missing secret configurations fail closed by rejecting the request or failing at startup.
Flask-RESTX endpoint documents authentication requirement with `@$DOC.doc(security=...)` but does not enforce it with an authentication decorator (e.g. `@common.api_token_authorization`, `@jwt_required`, `@login_required`).
Form action handler creates or verifies admin accounts without checking if an administrator account already exists. Unauthenticated users may be able to invoke this endpoint to create unauthorized admin accounts.
Gin router group $GROUP applies routes via applyRoutes without a prior $GROUP.Use(...) authorization middleware registration. Every request to these endpoints is reachable without authentication or authorization. Register an auth middleware (e.g., OAuth bearer-token check) on $GROUP before calling applyRoutes.
A Django REST Framework Create-style view (uses `CreateModelMixin`, `CreateAPIView`, or `ListCreateAPIView`) declares `permission_classes = [permissions.AllowAny]` while also defining a `serializer_class`, exposing a mutating/data-binding endpoint to anonymous callers. This is the unsafe pattern from CVE-2026-42864 (firefighter-incident `CreateJiraBotView`):
An HTTP request query parameter is assigned directly to options.plugins without validating that it is not a remote URL. Arelle's plugin manager loads `http(s)://` (and `+`/`-`/`~` prefixed) entries as remote Python modules to download and execute, which becomes an unauthenticated remote code execution vector when exposed over HTTP (CVE-2026-42796, CWE-306).
Laravel `Route::group` registers the legacy `/importer` endpoints without authentication or admin-authorization middleware. The route group only applies the `web` middleware (session + CSRF), which does not verify identity, so a remote unauthenticated attacker can invoke `ImporterController` actions (`@config`, `@dbtest`, `@run`, `@complete`) and trigger the
