Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Non-atomic single-use token (nonce) check: a replayed value is rejected with a SELECT (`->count()` / `->exists()`), but the token itself is only INSERTed later through a separate write. Concurrent requests replaying the same SAML assertion all run the SELECT before any sibling request commits its INSERT, so every request passes the guard and mints an authent
Unconfined path construction before a file read: a dynamic path segment $COMP is joined onto a base directory with os.path.join() and the result is opened without os.path.realpath() canonicalization and without a containment check. os.path.join() silently discards the base directory when $COMP is absolute, and os.path.normpath() only collapses ".." segments
Path $PATH is validated element-by-element after splitting on a path separator, or it is guarded only against leading "/" or "\\" absolute forms before being joined under a filesystem root, and the whole path is never checked for a DOS drive-letter prefix. On Windows, os.path.join(root, "C:/x") discards "root", so a hostile repository/archive entry named "C:
$UPDATE() overwrites the stored entity wholesale under the shared write lock without ever checking that the currently stored entity is not in a terminal (final) state. Terminal states must be immutable: with this blind write-back, a stale or racing caller (e.g. a cancel flow whose own earlier non-terminal check is raced by a completion or a second cancel) ca
An attacker-influenceable filesystem path reaches sqlite3.connect() by name. SQLite opens and, with creation semantics, creates whatever the final path component points to at each connect, so a local attacker who can create names in the database directory can plant a symbolic link (redirecting database creation and locking, or splitting mutual exclusion betw
$OPEN opens $PATH in write mode ($FLAGS) resolved purely by name and then the descriptor is written, but the open is not anchored to a vetted directory fd (no dir_fd=), is not non-blocking (no O_NONBLOCK, so a planted named pipe stalls the open forever), and the enclosing function never re-checks the descriptor's kernel identity with os.fstat (S_ISREG / st_d
This code moves a path aside with os.rename/Path.rename and later restores it by name with os.link without follow_symlinks=False. The original pathname stands empty between the rename-aside and the restore, so a local user with write access to the directory can create their own file at the emptied name (breaking mutual exclusion) or swap a symbolic link in a
A file path taken directly from a struct field (data that originates outside this function, e.g. a decoded request or plugin response) is passed to gin's Context.File/Context.FileAttachment without any validation or confinement. gin serves absolute paths as-is and resolves relative paths against the process CWD, so an attacker-controlled Path yields arbitrar
A shared cache of per-login, credential-scoped objects is keyed by plain string concatenation of only some of the login parameters and is published with a non-atomic containsKey/put/get sequence. Two logins that differ in an un-keyed identity-defining field (password, Kerberos service principal/realm, NTLM domain, JAAS login context, canonical-hostname flag,
This UPDATE re-queues a record by writing its status/state column while qualifying the row by identifier only. The current state is not restricted to terminal values and the number of affected rows is never verified, so a caller who knows the identifier can reset a record that is still queued or actively being processed back to the queued state (duplicate co
Order settlement creates the order document directly inside a request-driven payment confirmation flow without an atomic exactly-once claim on the associated transaction. Because the settlement create runs inside a request context (req) after only a payment-provider status check, any replayed or concurrent confirm request that resolves the same client-suppli
pluggy's eager loader load_setuptools_entrypoints() imports every module registered in the entry-point group, executing arbitrary import-time code, and only afterwards is the trusted-namespace allowlist (a startswith() prefix check on the already-imported plugin modules, e.g. plugin_module.__name__.startswith("docling.")) applied. This check-after-use orderi
Check-then-act SSRF: $URL is validated by $CHECK(...) but then fetched with an unpinned requests.* call. The validator only inspects the hostname at validation time; requests re-resolves DNS when connecting, so an attacker-controlled name can rebind to an internal address after the check (CWE-367), and any 3xx hop issued by the target is never re-validated (
$URL is checked by $VALIDATOR(...) and then passed to requests.$M(...). The validator resolves the hostname itself, but requests performs a second, independent DNS resolution when the connection is opened and is never pinned to the address that was validated. An attacker who controls DNS for the URL host can answer the first lookup with a public IP and the s
TOCTOU race in $FUNC: a $MODEL row is guarded only by a plain, non-atomic existence read ($MODEL.objects.first()/exists()), but the corresponding $MODEL.objects.create() runs outside any transaction.atomic() block and without a select_for_update() row lock. Two concurrent requests can both pass the guard and both create the row, breaking the at-most-one inva
A plugin-manifest validator inspects a manifest-supplied path field (e.g. `wasm_path`) but never component-validates its VALUE before that value is combined with trusted base directories via `Path::join` during plugin install/discovery (CVE-2026-101885). `Path::join` lets an absolute component (`/home/u/.bashrc`) replace the trusted base entirely and passes
Privileged filesystem mutation (write/chmod/chown/chgrp) on a path derived from a customer-controlled home directory without a containment re-check guarding the flow. The path string is validated only at derivation time; PHP re-resolves the path and follows symlinks when the operation executes, so a local user who controls the home directory can swap in a sy
A value read from a message/exchange header flows into a process command argument list without being normalized or confined to a base directory. An attacker who can set the header can make the external tool write (or read) outside the intended directory via an absolute path or ".." segments. Canonicalize the path (Paths.get($p).normalize()) and, when a base
A rate limit counter is read and updated using a non-atomic read-modify-write cache sequence. Concurrent requests can read identical counter values before writes occur, allowing attackers to bypass rate limiting via a race condition. Use an atomic increment operation instead.
Classpath entry is checked with ScriptApproval.using(entry) and its URL is loaded directly without localizing remote content to a local temporary file first. An attacker controlling the remote URL can return benign code during verification and malicious code when loaded by the ClassLoader (TOCTOU). Download remote classpath entries locally and verify using S
An outbound forced mirror push / LFS upload uses a remote address resolved from the stored git remote configuration without re-validating it against the migrations allow/block lists. The lists are only enforced when the mirror (or migration) is created, so a hostname that was allowed at creation time may later resolve to a blocked or internal address: on eve
Non-atomic read-modify-write of a shared counter: $OBJ.$ATTR is incremented or decremented in Python memory and the whole (stale) object is written back with save(). Concurrent request handlers load the same row snapshot, each applies the same arithmetic to its own copy, and every writer persists the same result (lost update, CWE-362), so a pickup/download l
Pathname-based permission or ownership operations (chmod, chown, lchown) on FTS traversal entries (fts_path or fts_accpath) are vulnerable to TOCTOU symlink races. An attacker with write access to the traversed directory can replace the entry with a symlink before chmod/chown runs, leading to unauthorized modification of arbitrary files. Instead, open the fi
Polkit's `unix-process` subject specification requires the `uid` field to be a signed 32-bit integer (`i32`, D-Bus type `i`). Passing an unsigned integer or converting `uid` without casting to `i32` causes Polkit to silently discard the UID and fall back to a racy `/proc` PID lookup, enabling PID reuse authorization bypasses (CVE-2026-78422).
