Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Session cookie is created with its Secure attribute bound to a static boot-time value ($1) instead of the security state of the client's actual connection. The kernel's single TCP listener is multiplexed into a plaintext-HTTP leg and a TLS leg that both receive the same raw handler, and a fixed-port reverse proxy re-issues requests upstream over HTTPS, so pe
Multimodal input validator rejects a present tensor because its reduced pixel sum is zero ($COND). Normalized image pixels can legitimately sum to exactly 0 (e.g. an image that is half black and half white under Normalize(0.5, 0.5)), so this shortcut discards a legal input, makes embed_multimodal() return no embeddings for an encoder step that still carries
Renewal handler re-issues the previously-issued auth object (&logical.Response{Auth: req.Auth}) and extends the lease TTL/Period without re-validating the original credential against its issuing authority. A principal can keep renewing the token after the upstream identity (e.g. a Kubernetes service account) has been deleted or its tokens revoked, persisting
Django proxy model `$MODEL` overrides `pk` with a @property but inherits `Model.delete()`/`QuerySet.delete()`, which build the DELETE predicate from the concrete primary-key column compared against the overridden `pk` value. Any instance or queryset delete through this proxy matches no rows, returns a success-shaped `(0, {})` result without raising, and sile
A file is opened for writing with os.open() using O_TRUNC create/clobber flags but without O_NOFOLLOW (or O_EXCL). os.open follows a symlink that already exists at $PATH, so content written through the returned file descriptor is truncated-and-written to the symlink's target, which can be outside the intended directory (CWE-59/CWE-61 symlink following / arbi
A delegated user-actor token (`tr_uat_` JWT) is minted without binding the id of the personal access token it derives from into the signed claims (`pat` claim). The token is stateless: with no `pat` claim the host cannot re-check the source PAT's liveness, so the delegated token survives revocation of its source PAT until expiry, and its capability cap canno
Archive extractor materialises attacker-controlled symlink entries and writes regular entries with a symlink-following open (O_CREATE without O_EXCL/O_NOFOLLOW) in the same routine. A symlink entry placed before a regular-file entry redirects the write outside the staging tree (e.g. into a live configuration path), enabling persistent configuration injection
A session authentication/verification flag is conditionally inherited from a previous session, but the deny-guard short-circuits on the mere truthiness of the previous identity ($PREV_ID && ...). When the previous session has no bound identity (e.g. it was logged out and only the flag was left behind, or it predates identity binding), the guard evaluates fal
Incomplete session invalidation: a session whose identifier matches a skip value is deliberately spared by $SESSION.destroy(), or the current session id is stored as an invalidation-skip option. When this protects a password change or reset, the spared session id is exactly the value carried in the user's session cookie, so a stolen or cloned cookie keeps au
Caller-supplied mapping $OPT is mutated in place ($OPT[$K] = $OPT.get($K, $DEFAULT)) under a condition read from the same mapping. Dict arguments are aliased, so the caller's mapping is silently modified with these injected defaults. If the caller reuses the same mapping for a later call with stricter settings (e.g. verification re-enabled), the stale defaul
XML is parsed after libxml_disable_entity_loader(true) was called with the '@' error-suppression operator and/or without checking its return value, so parsing still happens when external entity loading could not be disabled (fail-open guard). On PHP < 8.0 with libxml < 2.9.0 this enables XXE (CWE-611/CWE-918) in attacker-controlled XML metadata: local file d
$RESET directly issues a live-session invalidation for the single room it was handed and never enumerates the resource's descendants. Permissions are inherited down the resource hierarchy, so a revocation or link-configuration change on an ancestor changes the effective rights of every sub-document, while websocket sessions already open on those children kee
Untrusted input reaches Smooks XML parsing (filterSource) through a raw Smooks StreamSource/ByteSource/ReaderSource without XML parser hardening. Smooks parses such a source with its default reader (e.g. Woodstox), which resolves external general/parameter entities and loads external DTDs, so an attacker who controls the document body can read local files an
The stateless API middleware group authenticates requests with a bearer-token guard ('auth:api'/'auth:sanctum') but never registers a middleware that re-checks the account's activated/enabled state on every request. Token authentication only validates the credential itself, so a personal access token issued before the account was deactivated keeps authentica
A token parameter is decrypted and parsed as JSON, but its contents are returned without verifying an expiration timestamp against the current time. This creates non-expiring bearer credentials that can be replayed indefinitely.
SAXParser is created from SAXParserFactory without disabling DOCTYPE declarations or external entity resolution. This can lead to XML External Entity (XXE) injection vulnerabilities when parsing untrusted XML data. Ensure `disallow-doctype-decl` or entity resolution features are explicitly disabled.
A SAML LogoutRequest handler destroys the SP session with $HANDLER.destroySession(...) using a key ($KEY) derived from the attacker-controlled SessionIndex/NameID of the request, and the enclosing code never verifies that the requester is authenticated (SAMLPeerEntityContext.isAuthenticated(), which is only true after the request signature was validated agai
Unhardened JDOM2 SAXBuilder: the parser is created with defaults that leave DOCTYPE declarations, external general/parameter entities and external DTD loading enabled. If the parsed XML is attacker-influenced (e.g. an imported OPML document), a DOCTYPE with SYSTEM entities makes the application read local files or issue requests to internal network addresses
WSSE UsernameToken authentication recomputes the digest from the client-supplied Nonce and Created values plus the stored password and grants access by a plain String equality against the client-supplied PasswordDigest, without enforcing nonce uniqueness (replay cache) or Created-timestamp freshness. A captured X-WSSE header therefore stays valid forever and
Flask-Login stores `_user_id` in session data as a string (via `User.get_id()`), whereas database user models typically define `id` as an integer column. Directly comparing `_user_id` with `user.id` without casting evaluates to False in Python 3, causing session revocation or lookup to silently fail. Cast both identifiers (e.g., `str(...)`) before comparing.
A client-supplied stmtIds array is accepted here after only a length check (and stmtId/stmtIds mutual exclusion); its values are never checked for uniqueness or non-negativity. Duplicate or negative statement IDs violate the retryable-write/applyOps bookkeeping invariant, which is only enforced later by fatal assertions - the resulting crash state can be dur
Internal expression '_internalIndexKey' is registered without restricting client access to internal cluster nodes, allowing external clients to trigger an assertion failure DoS.
Using assert() for bounds checking before memcpy() can lead to buffer overflow when NDEBUG is defined, or denial of service when untrusted inputs trigger an abort. Use explicit runtime boundary checks instead.
Directly accessing `ExpiresAt.Time` on JWT claims without checking if `ExpiresAt` is nil causes a nil pointer dereference panic for tokens without an expiration (`exp`) claim. This can crash revocation and logout handlers, allowing tokens to remain valid.
