Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The Express application hosting Model Context Protocol (MCP) transports calls `app.listen()` without specifying an explicit host or bind address. In Express, omitting the host defaults to binding on all network interfaces (`0.0.0.0`), exposing MCP tools to any reachable network client. Explicitly bind to a loopback address (e.g., `127.0.0.1`) or enforce inbo
`SubmoduleConfigParser` is instantiated without `merge_includes=False`. This allows untrusted `.gitmodules` files to execute `[include]` directives and read arbitrary local files on the system.
Calling ListenTCP with hardcoded allInterfaces=true binds the forwarded port listener to all network interfaces (0.0.0.0) instead of restricting it to loopback, exposing forwarded services to network-adjacent hosts.
GitHub Copilot instruction frontmatter lacks 'excludeAgent' scoping annotation.
Context values are unsafely stored in a mutable array and manipulated via push/pop operations around async boundaries. During concurrent asynchronous rendering, state from different requests can interleave, causing cross-request data leakage. Migrate your context storage to an async-local storage abstraction to isolate state per request.
InMemoryListenerConfig is configured without specifying a listen address, which binds the LDAP server to all network interfaces (0.0.0.0). Specify a loopback address using createLDAPConfig(listenerName, InetAddress.getLoopbackAddress(), listenPort, socketFactory) to prevent unintended network exposure.
Appending to an array with `$ARR[$ARR.length] = $VAL` invokes [[Set]], which traverses the prototype chain. If Array.prototype[N] has an attacker-installed setter (e.g., from sandbox/cross-realm code), that setter receives the appended value — potentially including sensitive internal state — before the caller regains control. Use Reflect.defineProperty or Ob
`$ARR[$ARR.length] = $VAL` appends to an array via an ordinary index assignment, which walks `Array.prototype` before creating an own slot. In sandbox or cross-realm bridge code, an array literal `[]` allocated inside a closure shared with the untrusted realm inherits that realm's `Array.prototype`. An attacker can pre-install a numeric-index setter (e.g. `O
Hono node server (or equivalent serve() call) is bound to "0.0.0.0", exposing the service on every network interface. Local developer tools that expose privileged endpoints (process spawn, file access, plugin install) must bind to the loopback address ("127.0.0.1") to prevent remote attackers — including drive-by browser requests from malicious sites — from
The Uvicorn server is configured to bind to all network interfaces ('0.0.0.0' or '::'). This publicly exposes the service on all available interfaces by default. Bind to a loopback host (such as '127.0.0.1') or use a configurable environment variable instead.
WebSocketServer is instantiated without an explicit `host` parameter. The `ws` library defaults to 0.0.0.0 (all network interfaces) when `host` is omitted, exposing the server to any remote attacker with network access to the port. Set `host: '127.0.0.1'` to restrict to localhost unless external access is explicitly intended and separately protected by authe
Data is being aggregated based purely on the `.scanner` property. This fails to differentiate by scan type, leading to business logic flaws where distinct scan reports clobber each other's vulnerabilities. Group by a composite key including both `.scanner` and `.scan_type` or `.report_type`.
webpack-dev-server is configured with a `proxy` (or `contentBase`) but without an explicit `host` binding. Recent versions of webpack-dev-server bind to all network interfaces by default, and webpack-dev-server has no built-in authentication: any host reachable on the dev server's port can pivot through the configured proxy rules (for example forwarding /api
A vulnerability resolution service is being invoked with only a pipeline ID, scanner ID, and ingested IDs, without distinguishing the specific report type. This logic flaw can cause a Denial of Service of security reporting in systems where different types of reports (such as SBOM vs. continuous scanning) use the same underlying scanner ID, allowing active v
Grouping security scan results solely by `scanner` identity without `scan_type` causes collisions between different report types (e.g., SBOM and DS). This can lead to legitimate vulnerabilities being erroneously marked as resolved or no longer detected. Use a composite key including both `scanner` and `report_type`.
A wrapper class delegates attribute access using `getattr()` without handling `AttributeError`. In Python 3.10+, `AttributeError` instances include an `obj` attribute that contains the object being accessed. If the `getattr()` call is allowed to propagate an `AttributeError` from the wrapped object, untrusted code catching this exception can extract the wrap
Vulnerabilities clustered by scanner alone without report_type can result in erroneous resolutions across scan types. Ensure vulnerability aggregation and resolution accounts for both the scanner identity and the report type.
