Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Polkit's `unix-process` subject specification requires the `uid` field to be a signed 32-bit integer (`i32`, D-Bus type `i`). Passing an unsigned integer or converting `uid` without casting to `i32` causes Polkit to silently discard the UID and fall back to a racy `/proc` PID lookup, enabling PID reuse authorization bypasses (CVE-2026-78422).
Data returned from unserialize() is checked with empty() without verifying that it is an array using is_array(). Deserialized non-array scalar values can cause runtime TypeErrors when assigned to typed array properties or used in array operations.
Iterating over Parse logical operators ('$or', '$and', '$nor') and gating processing only on Array.isArray(where[op]) allows an attacker to supply an array-like object (e.g. { '0': {...}, length: 1 }). The Array.isArray branch is skipped while downstream code can still iterate the object, silently bypassing recursive guards (such as protectedFields enforceme
Direct index access and unchecked type assertion on a DNS message slice (e.g., `Answer`, `Ns`, `Extra`) can result in out-of-bounds access or type assertion panics if the DNS response is modified, empty, or contains unexpected record types. Iterate over the slice and use a comma-ok type assertion instead.
When converting a byte array containing a hash signature to a human readable string, a conversion mistake can be made if the array is read byte by byte.
KotlinCWE-704The application is using `Integer.toHexString` on a digest array buffer which may lead to an incorrect version of values. Consider using the `java.util.HexFormat` object introduced in Java 17. For older Java applications consider using the `javax.xml.bind.DatatypeConverter`. Example using `HexFormat` to create a human-readable string: ``` // Create a Message
JavaCWE-704When converting a byte array containing a hash signature to a human readable string, a conversion mistake can be made if the array is read byte by byte.
ScalaCWE-704
