Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Polkit's `unix-process` subject specification requires the `uid` field to be a signed 32-bit integer (`i32`, D-Bus type `i`). Passing an unsigned integer or converting `uid` without casting to `i32` causes Polkit to silently discard the UID and fall back to a racy `/proc` PID lookup, enabling PID reuse authorization bypasses (CVE-2026-78422).
Sensitive data is written to a temporary file before restrictive file permissions are set, exposing a race condition window where other local users can read the temporary file contents. Ensure restrictive permissions are applied to the directory or file prior to writing data.
Sensitive data is written to a temporary file before setting restrictive permissions via chmod. This creates a race condition (CWE-377 / CWE-378) where unprivileged local processes can read the file contents before permissions are modified. Set directory permissions beforehand or create the file atomically with restrictive permissions prior to writing.
Sensitive data is written to a temporary file before setting restrictive permissions on the temporary directory or file, creating a race condition where local users can read sensitive data. Set directory permissions (e.g. chmod 700) or create files atomically with secure permissions before writing.
Writing sensitive data to a temporary file before setting restrictive permissions creates a race condition (TOCTOU) where other local processes can read file contents. Restrict parent directory permissions beforehand or create the file atomically with restrictive permissions.
Sensitive data is written to a file before restrictive permissions are applied via chmod. This introduces a race condition (TOCTOU) where the file is readable by other local users with default permissions before chmod executes. Secure the containing directory or pre-create the file with secure permissions before writing data.
When copying or initializing a knote, checking the source knote's KN_QUEUED status instead of verifying the newly copied knote's state can lead to double-enqueuing and kqueue list corruption if an event triggers concurrently.
The application declares a P/Invoke signature for the non-reentrant POSIX functions `getpwuid` or `getgrgid`. These functions return pointers to shared static memory, leading to race conditions, identity confusion, or memory corruption in concurrent environments. Use their thread-safe, reentrant counterparts `getpwuid_r` and `getgrgid_r` instead.
Multiple user store operations in an authentication workflow directly access a mutable struct field without capturing a consistent instance reference, which can cause state inconsistencies during store swaps.
Using standard fopen() with write or append modes ('w', 'w+', 'a', 'a+') does not enforce O_NOFOLLOW or O_EXCL flags, exposing file creation to symlink following attacks (CWE-59) and non-atomic create race conditions (CWE-377, CWE-362). Use open() with appropriate flags (e.g., O_NOFOLLOW | O_EXCL) and convert to FILE* using fdopen() if required.
Capturing reactive stream errors into an instance field of a shared handler or decorator can cause race conditions and cross-request information leakage. Scope error state locally within the method/stream execution instead.
The `strtok()` function is non-reentrant and intrinsically thread-unsafe due to its use of a shared static buffer to store state. In multi-threaded contexts such as PAM modules, using `strtok()` can cause race conditions, leading to corrupted token parsing and unauthorized or denied accesses. Furthermore, `strtok()` mutates strings in-place; directly passing
Dynamically modifying the Kubernetes configuration context via `setCurrentContext` on an existing client object creates a critical race condition in concurrent environments (Context Confusion). During concurrent execution, commands designated for one cluster might inadvertently execute on whichever cluster context was set last globally. Pass per-execution co
Time-of-Check-Time-of-Use (TOCTOU) race condition detected during first user registration. Checking the active user count before insertion can allow multiple concurrent requests to evaluate as the "first user" and be granted administrative rights. Insert the newly registered user with a default standard role first, then evaluate the user count strictly post-
prctl(PR_SET_DUMPABLE, 1, ...) is called unconditionally without a boolean guard. In privilege-separated (setuid) architectures where the calling process still holds a privileged IPC channel to a root parent, an attacker sharing the same UID can ptrace-attach to this now-dumpable process and inject arbitrary privileged operations through that channel. Add a
Concurrent modification of a receiver's map or fields in an HTTP handler without synchronization is unsafe. In Go, concurrent map writes cause a fatal runtime panic (fatal error: concurrent map writes), leading to process termination and Denial of Service (DoS). Protect shared state with a synchronization primitive like `sync.Mutex` or `sync.RWMutex`.
Directly mutating properties (e.g., `Timeout`, `Transport`, `CheckRedirect`) of a shared `http.Client` structure (such as via a method receiver field) without synchronization can cause a race condition. This cross-request state contamination might result in leaking credentials or routing behavior to concurrent requests. Instead of mutating a shared `http.Cli
Modifying a receiver's field inside an HTTP handler or middleware leads to a data race if the middleware is instantiated once and shared across multiple concurrent requests. Store per-request state in the request context or return a new instance per request.
Using z_abort_timeout() when unscheduling delayable work can race with an in-flight timeout handler on SMP systems, causing use-after-free. Use z_try_abort_timeout() and handle in-flight timeouts.
The code identifies a free bit in a bitmap using `find_lsb_set` and modifies it without holding a lock. On SMP systems, multiple threads can concurrently observe the same free bit, leading to a race condition. Missing synchronization around the array read-modify-write causes multiple threads to acquire the same index. Wrap the access in a `k_spin_lock` or eq
The `blk_discard` array used for processing UNMAP requests is accessed from a shared structure rather than a per-request structure. This creates a race condition during concurrent UNMAP commands, leading to data corruption and DoS. Move this state into a per-request structure such as `SRB_EXTENSION`.
Performing non-transactional database mutations (such as update or delete) inside a pre-deletion event listener (e.g., `*Deleting`) can lead to race conditions and persistent data inconsistencies. If the parent deletion aborts or fails, the side effects applied by this listener cannot be rolled back, causing orphaned records. Move this cleanup logic to a pos
Frame progress is reported before side data is fully exported, creating a data race condition where other threads may read incomplete or corrupted frame side data. Ensure `ff_progress_frame_report` is called only after all frame data, including side data, has been attached.
Appending directly to a slice parameter might modify its underlying array in-place if capacity > length. In a concurrent context, this causes data races and memory corruption (e.g., cryptographic keys). Allocate a new slice using `make`, then copy or append the parameter's contents into it.
