Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Calling `constructor.isBuffer(...)` without checking `typeof ... === 'function'` can throw an unhandled TypeError if an object with a non-callable `constructor.isBuffer` property is provided.
Calls to squashfs.Read on potentially untrusted squashfs images without panic recovery can cause a denial of service if malformed image headers trigger runtime panics in go-diskfs.
Object parameter decoding iterates over schema properties without validating incoming parameter keys against allowed properties when additionalProperties is disabled, or performs unchecked type assertions on parameter maps.
Missing `check_no_metavar_no_fvar` check on declaration value before type checking. Opaque or definition declarations containing unvalidated free variables or metavariables can bypass kernel soundness checks via type checker cache lookup.
Calling `.unwrap()` or `.expect()` on `GeneralizedTime::from_system_time` or `UtcTime::from_system_time` can cause an unhandled panic and denial-of-service if the timestamp falls outside the ASN.1 supported range (e.g., 1970-9999). Propagate or handle the `Result` instead.
Calling .First() throws an InvalidOperationException when no item is found, making subsequent null checks unreachable and causing unhandled exceptions. Use .FirstOrDefault() instead.
Kafka tombstone records deliberately carry a `null` value in their message body. When this `null` value is passed directly as the constructor argument for buffer wrappers like `ReadOnlySequence`, `Memory`, `ReadOnlyMemory`, or `MemoryStream` without a check, an `ArgumentNullException` is thrown. In the context of a message processing loop, completely unhandl
Request input is passed directly to search repository methods without type casting or empty checks, which can cause unhandled TypeErrors or unexpected query execution when parameters are omitted.
Using assert() to validate the quantization style bits (Sqcd & 0x1F) in JPEG2000/HTJ2K codestreams causes an unconditional process crash (DoS) on malformed input. Use runtime validation with error handling instead.
Directly accessing an element of a list comprehension (e.g., `[x for x in iterable][0]`) without verifying that the resulting list is not empty can raise an `IndexError`. If the iterable is derived from missing or malicious input elements, this leads to an unhandled exception and Denial of Service (DoS). Assign the comprehension to a variable and check its t
Validation of path traversal using `.starts_with("../")` on a glob string is insufficient because inline traversals (e.g., `src/../../file`) bypass it. Combined with silently dropping parsing errors (`if let Ok(...)`), an attacker can cause checks to be bypassed by providing malformed or inline-traversed globs. Ensure robust path validation (e.g., `.contains
'$RESP.$FIELD' is accessed before '$RESP' is nil-checked. When the upstream call returns nil (for example on a 404 or transport error), this dereference causes a nil pointer dereference panic (CWE-476). Move the field access '$X = $RESP.$FIELD' to after the nil/error guard block so that it only executes when '$RESP' is confirmed non-nil.
HTML serialization in SPLIT_PAGE mode omits content for single-page documents due to a missing fallback when no page-breaks are encountered. Ensure single-page scenarios capture content even when `next_page` is None.
Missing fallback logic to capture a single-page document during HTML split-page serialization. Content is silently dropped if pagination boundaries are not found.
Checking for integer overflow after a multiplication has occurred can lead to undefined behavior if the variables are signed. Modern compilers may optimize away these checks since signed integer overflow is undefined. To prevent this, verify that the operation will not overflow before performing it, using division (e.g., `if (X != 0 && Y > INT_MAX / X)`).
An overly strict path traversal check rejects operations when `realpath()` returns `false`. Because `realpath()` returns `false` for non-existent directories, this improperly blocks operations (like archive extraction) where the target directories are meant to be dynamically created, leading to a Denial of Service.
When an HTTP stream handler accumulates payload size and checks it against a `content-length` limit parsed with `Number()`, `parseInt()`, or `parseFloat()`, it can fail open. For chunked requests, missing headers cause these parsers to return `NaN`. Because numeric inequalities evaluate to false against `NaN` (e.g., `size > NaN`), an attacker can circumvent
URL scheme validation throws a generic Error instead of a project-specific error class (such as ActionableError). In highly specific framework environments, generic exceptions might not be properly handled, routed, or surfaced to the client, which can cause security validation failures to be silently suppressed or incorrectly processed.
Validation of `Vec<String>` argument length uses `> 2` instead of `>= 2` before extracting an element at index 1. This off-by-one error causes the argument to be skipped entirely when exactly 2 items are present (the command and a single argument), potentially leading to logic bypass or argument type confusion.
Using `panic!` inside libp2p `ConnectionHandler` negotiation events (`FullyNegotiatedInbound`, `FullyNegotiatedOutbound`) exposes the application to remote Denial of Service (DoS) attacks. An attacker can intentionally negotiate duplicate streams or unexpected states to trigger the panic and crash the node. Handle invalid states gracefully by returning an er
Using `.expect()` or `.unwrap()` on the result of a checked arithmetic operation (e.g., `checked_add`, `checked_sub`) causes a runtime panic on overflow/underflow. When processing untrusted input, this leads to Denial of Service (DoS) due to reachable assertions. Handle the error gracefully using `.ok_or(...)?` or a `match` statement.
`bgp.ValidateUpdateMsg` is called without checking if the message has already been flagged as malformed in previous parsing steps. Unconditionally validating malformed attributes may result in an unhandled panic, potentially causing a Denial of Service. Ensure the validation is guarded by checking that the state is priorly verified (e.g., `handling == bgp.ER
`SimpleCookie.load()` or `BaseCookie.load()` can raise a `CookieError` on malformed inputs. If this method is called on user-supplied data without a `try...except` block, it can cause an unhandled exception, leading to a Denial of Service (DoS). Wrap the `load()` call in a `try...except` block to handle exceptions safely.
Calling 'URL.domainToASCII()' relies on a non-existent static method on the global 'URL' constructor. This throws a TypeError at runtime, which if caught silently in a try-catch block will bypass IDN/domain canonicalization.
