Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Falling back to plan.actions when token-based lookup from an internal store fails allows execution of unverified or forged actions. Ensure the token exists in the store and do not fall back to untrusted actions supplied in the plan object.
Comparing claimed or stored `fingerprint` attributes directly instead of recomputing the cryptographic fingerprint from the actual public key material allows key substitution attacks when metadata is untrusted or tampered with.
Macro command executed without preceding shortcuts.xml HMAC validation.
STUN attribute parsing using `stun_attr_get_next_str` or `stun_attr_get_next` processes trailing attributes past MESSAGE-INTEGRITY, allowing an on-path attacker to inject unauthenticated STUN attributes. Use `stun_attr_get_next_covered_str` or `stun_attr_get_next_covered` instead.
Gleam extracted package `outer_checksum` or `requirements` directly from the unverified `hex::get_package_release` API response rather than the signed Hex registry metadata. An attacker capable of intercepting TLS traffic could forge the checksum, causing the application to verify and accept malicious package tarballs. Extract these security fields from the
`crypto_dispatch` return value only reflects dispatch status; cryptographic operation errors (such as MAC authentication failure) are recorded in `crp_etype`. Failing to check `crp_etype` can allow unauthenticated or forged ciphertexts to be processed.
Authenticating transparency log child tiles using `len(stx)` as the starting index instead of the actual number of tiles fetched (`stxTileOrder[len(stx)-1] + 1`) allows unauthenticated tiles to bypass parent hash verification when multiple subtree hashes share a tile.
Raw response data is cached/returned instead of verified record text from tlog.ParseRecord, allowing unauthenticated checksum lines to be accepted.
SCTP State Cookie is accepted without cryptographic HMAC authentication or creation timestamp verification.
A DNS lookup callback receives a DNSSEC validation status but processes a successful response (`LDNS_RCODE_NOERROR`) without checking for `sec_status_bogus`. This allows an attacker to spoof BOGUS responses, bypassing DNSSEC validation boundaries. Ensure the security status is validated prior to trusting the lookup result.
Rewriting handler acts on DNS answers without verifying their DNSSEC security status. This can allow spoofed BOGUS answers to be rewritten, effectively bypassing validation. Ensure the handler asserts the security status before proceeding.
Multi-log threshold verification relies on an integer counter incremented per valid entry instead of tracking unique log authority identifiers in a set or map. This allows multiple log entries from a single log authority to satisfy the multi-log threshold requirement.
OAuth state parameters are parsed directly from unauthenticated base64 JSON without cryptographic signature or nonce verification. An attacker can tamper with state fields to bypass authorization checks or conduct CSRF attacks.
The stream parsing logic sequentially reads and decodes chunk data based on an unverified `.isFinal` property. If the parser is unaware when an EOF is missing a valid trailing chunk, an attacker can silently truncate bodies. Track `.isFinal` state and emit a validation error upon outer body completion if the final chunk was not observed.
A UDP datagram is received and its data is processed without validating the source address or port. This pattern is associated with vulnerabilities like CVE-2026-46560 (BlastRADIUS / RADIUS Spoofing), where an unauthenticated attacker sends spoofed UDP responses to a client's ephemeral port. Always verify the origin of UDP datagrams using `getAddress()` and
NFS filehandles are decoded using an exportfs decode function without cryptographic verification. Because standard NFS filehandles are traditionally predictable, an unauthenticated network attacker can guess them to bypass path-based access controls and access restricted files. Ensure incoming filehandles are cryptographically verified (e.g., using `fh_verif
Struct field "$FIELD" holds a JWT/HMAC signing secret that is loaded from the environment without a minimum-length validation constraint. A decoded secret shorter than 32 bytes makes HS256 tokens brute-forceable offline (RFC 7518 §3.2 mandates ≥256-bit keys for HS256). Add `validate:"gte=32"` (or higher) to the struct tag so the application rejects an unders
NFS filehandles are predictable and lack cryptographic signatures. Decoding incoming filehandles without validating their authenticity allows an attacker to bypass path-based access controls by systematically guessing valid filehandles. Filehandles should be authenticated (e.g., via MAC check) before decoding.
A custom HTTP stream reader is created from an HTTP request body but fails to clear or sanitize `req.Trailer`. Go's `net/http` server automatically populates this field with trailing headers upon reading a chunked request. If the application later trusts these unverified trailers (e.g., for metadata or chunk signatures), attackers can smuggle unsigned traili
Rack::Session::Cookie#unpacked_cookie_data falls back to an unauthenticated coder (e.g. Base64::Marshal) when configured encryptors fail to decrypt the cookie. Because encryptor failures are rescued and ignored, an attacker can forge a session cookie that fails authenticated decryption but is still parsed by the fallback coder, leading to authentication bypa
ForwardAuth-style request builder calls utils.CopyHeaders to bulk-copy every incoming request header into the forwarded auth request and then only selectively rebuilds a fixed subset of X-Forwarded-* headers (For / Method / Proto / Port / Host / Uri). Other X-Forwarded-* headers such as X-Forwarded-Prefix are not stripped, so when the trust-forward flag is f
Client identifiers extracted from worker message event payloads (`event.data.clientId`) are self-reported and untrusted. Using `event.data.clientId` to register or route MessagePorts allows untrusted contexts to spoof client IDs and hijack inter-context communication. Rely on browser-verified context identifiers such as `event.source.id` in ServiceWorkers in
Cache key serialization for a protobuf Struct must prefix the number of fields (e.g. via strconv.Itoa(len(keys))) and sanitize Unicode control characters in string values. Without a length prefix, a single-key value containing the literal field delimiter (e.g. ",'b:'y") serializes identically to a structurally different two-key Struct, producing the same cac
The authentication tag for AES-GCM decryption is extracted using `substr` but its length is not validated. If an attacker provides a short payload, `substr` may return a truncated tag which `openssl_decrypt` accepts, allowing brute-force attacks to recover the GHASH key and forge ciphertexts. Verify the tag length using `strlen` before passing it to `openssl
