Rule Explorer

AEAD finish function calls decrypt without checking the return value before comparing tags, potentially accepting unauthenticated inputs.

CCVE-2026-75803CWE-354

`crypto_dispatch` return value only reflects dispatch status; cryptographic operation errors (such as MAC authentication failure) are recorded in `crp_etype`. Failing to check `crp_etype` can allow unauthenticated or forged ciphertexts to be processed.

CCVE-2026-58085CWE-345CWE-354

When a dynamically generated atom (`String.to_atom/1`) is pinned in a pattern match inside a `case` statement, matching against structures with strings causes silent fall-through to the catch-all branch. In contexts like package resolution, this can silently bypass dependency signature and checksum evaluations, allowing tampered packages to be installed and

ElixirCVE-2026-32148CWE-345CWE-354

The middleware accesses `request_checksum_calculation` from global configuration without checking the command context, potentially bypassing required checksum validations.

PHPCVE-2025-69820CWE-354

A comparison using `zip` and `fold` was detected without a preceding length equivalence check. The `Iterator::zip` method stops when the shortest iterator is exhausted. If an attacker provides a partial input shorter than the expected input but matching its prefix, `zip` will successfully evaluate to true, causing an authentication or comparison bypass. Expl

RustCVE-2024-21491CWE-354CWE-697