Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A Livewire form containing a password input uses the `wire:submit` directive without the `.prevent` modifier. In older versions of Livewire, this omission causes the browser to perform a native HTML GET submission by default. This causes sensitive credentials (like user passwords) to leak directly into the URL query string, where they can be cached in browse
Call to securityStrategy.login() is not preceded by a login rate-limit check in the enclosing function. Authentication entry points must be throttled to prevent online brute-force / credential-stuffing attacks (CVE-2026-41893, CWE-307). The HTTP routes /login and /signalk/v1/auth/login are guarded by express-rate-limit, but WebSocket message handlers invokin
A verification-code verify-style function retrieves a stored OTP and immediately returns a constant-time equality comparison without incrementing an attempt counter or invalidating the code on repeated failures. With small code keyspaces (e.g. 6-digit OTPs) and a multi-minute TTL, this allows brute-force account takeover when the external rate limiter is abs
A missing rate-limit check before verifying an authentication code allows an attacker to brute-force the code. Ensure that rate limiting, such as `check_email_authentication_attempt`, is enforced and its error is handled before querying for the authentication code.
The "current password" submitted to a change-password handler is verified with a bare check_password() call that has no failed-attempt counting, lockout, or notification side effects. An attacker holding an authenticated session can brute-force the user's password by replaying this endpoint without ever being rate-limited or locked out. Validate the submitte
