Rule Explorer

Bit index is erroneously divided by 8 when supplied as a bit offset to tvb_get_bits*, causing unit mismatch and potential out-of-bounds read.

CCVE-2026-76880CWE-125CWE-682

Performing string replacement with `strings.Replace` or `strings.ReplaceAll` using a substring match returned from regex search on `$INPUT` replaces the first value match in `$INPUT` rather than at the regex match index. If the matched substring occurs earlier in `$INPUT`, the wrong substring will be replaced. Use index offsets (e.g., `FindStringMatchIndex`)

GoCVE-2026-73505CWE-682

Authenticating transparency log child tiles using `len(stx)` as the starting index instead of the actual number of tiles fetched (`stxTileOrder[len(stx)-1] + 1`) allows unauthenticated tiles to bypass parent hash verification when multiple subtree hashes share a tile.

GoCVE-2026-56865CWE-345CWE-682

Using filter() to remove empty arrays from a multi-dimensional graph representation (like connections or outputs) causes the indices of subsequent elements to shift downward. In topological structures where the array index strictly implies a specific execution branch or slot, this results in silent rewiring, logic bypasses, and data corruption. Instead of us

TSCVE-2026-54052CWE-664CWE-682

The query manager selects only 'd' closest peers rather than 'k' closest peers for routing table initialization. This drastically weakens the robustness of disjoint lookup paths, making the DHT vulnerable to eclipse attacks. Ensure the routing table closest peers matches the expected bucket size 'k' before routing them into separate initial paths.

TSCVE-2026-46679CWE-682

Filtering out all empty arrays from workflow connections incorrectly shifts subsequent connection indices. In multi-output nodes, this corrupts the mapping between array indices and output ports, potentially bypassing logical conditions or redirecting data. To maintain index stability, only strip trailing empty arrays (e.g., using a while loop with .pop()).

JSCVE-2026-45707CWE-682

Filtering out empty nested sub-arrays removes intermediate items and shifts all subsequent indices. In structures where array indices provide semantic mapping (e.g., node output logic branches or protocol ports), this incorrectly recompiles connection maps, causing data corruption or authentication bypasses. If array indices represent immutable identifiers,

TSCVE-2026-45582CWE-682

The parser passes an incorrect expected item count of 5 to SkipTheRest, instead of 3. This causes trailing extension fields to be ignored and bypasses underlying structural validation in MessagePackReader.

C#CVE-2026-44375CWE-682

Aggressive empty element filtering on a position-dependent (sparse) sub-array shifts subsequent indices, corrupting mappings that rely on index position. Remove trailing empty structures carefully instead of indiscriminately filtering intermediate empty arrays.

TSCVE-2026-42449CWE-682

Fixed-point coordinate step increment calculation is assigned directly to a context field without validating that the increment falls within safe bounds (such as bounds checking against INT_MAX or minimum threshold). Extreme source/destination dimension ratios can cause integer overflow or out-of-bounds access in downstream scalers.

CCVE-2026-38348CWE-190CWE-682

CTTS sample offsets are read directly as unsigned values without checking for negative signed offsets in QuickTime format.

C++CVE-2026-36908CWE-190CWE-682

Constructing a field element type directly from a raw integer without modulo reduction or bounds checking can lead to unreduced elements. When these elements are compared for equality or used in some cryptographic arithmetic, they may yield incorrect results or allow validation bypasses. Mathematically equivalent elements will have distinct binary representa

RustCVE-2026-32322CWE-682

A logic flaw causes incorrect rounding when both the intermediate product and divisor are negative. The logic assumes a negative intermediate implies a negative result, neglecting the sign of the divisor. Attackers could trigger this path to cause precision deviations and break expected math boundaries.

RustCVE-2026-24783CWE-682

A BigNumber or similar structure applies a bitwise mask to an array of components based on length, but fails to account for the state where length becomes 0. This corrupts the instance invariants, causing operations like `isZero()` to fail and resulting in infinite loops.

JSCVE-2026-2739CWE-682CWE-835

Child VM gas limit is not bounded by the parent's actual remaining gas. This allows a gas accounting discrepancy leading to unexpected OOG exceptions that can pollute or corrupt virtual machine states.

C++CVE-2025-70956CWE-682

The QuoRem implementation performs division via truncation (using `Div`) instead of symmetric rounding. This mathematically violates the Euclidean domain property, leading to infinite loops in Half-GCD operations (Denial of Service). Additionally, mutating the receiver `z` early before completion can lead to aliasing bugs if it points to the same memory as t

GoCVE-2025-58157CWE-682CWE-835

Checking for interval overlap by verifying if the endpoints of one interval fall within another interval is logically flawed. This fails to detect overlap when the first interval completely encapsulates the second. Use the mutually exclusive bounds check instead: '!(end1 < start2 || end2 < start1)'.

CCVE-2024-55627CWE-191CWE-682

Unconditionally clearing the 'Restored' flag of a register in CalleeSavedInfo during local block optimization can lead to miscompilation. CalleeSavedInfo represents global function state; modifying it locally without verifying all function paths (e.g., other return blocks) may cause registers to be left unrestored, leading to control-flow errors or crashes.

C++CVE-2024-31852CWE-682