Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Unhandled Err from $TIME.duration_since($EPOCH): duration_since() returns Err(SystemTimeError) whenever the timestamp precedes 1970-01-01, so the .unwrap()/.expect() here panics on pre-epoch (negative-seconds) values. If the timestamp is attacker-influenced (e.g. a guest-supplied file time later applied with futimens/utimensat), the panic escapes the host-ca
Django proxy model `$MODEL` overrides `pk` with a @property but inherits `Model.delete()`/`QuerySet.delete()`, which build the DELETE predicate from the concrete primary-key column compared against the overridden `pk` value. Any instance or queryset delete through this proxy matches no rows, returns a success-shaped `(0, {})` result without raising, and sile
Broker message headers are parsed with $EXTRACT inside a try block whose only handler stops the whole application ($LIFETIME.StopApplication). An attacker who can publish to the consumed queue can send a malformed message header (e.g. an unparsable cloudEvents:time, an invalid cloudEvents:motorversion or a lone double-quote value) so that the extraction thro
`$VAL.to_str()` is unwrapped with a panicking combinator, asserting that the header value is entirely visible ASCII. HTTP header values are opaque bytes (RFC 9110): `HeaderValue::from_bytes` accepts non-ASCII bytes (0x80-0xFF) that `to_str()` rejects, and values pulled from a fetched response's HeaderMap (or stored from script input via `from_bytes`) carry w
$X comes from JSON.parse() and is accepted as a JSON object using only a null-check and a `typeof $X !== 'object'` guard. In JavaScript `typeof [] === 'object'`, so a JSON array passes this validation and is treated as a valid object. For structured payloads such as a JWT Claims Set (RFC 7519 section 7.2 step 10 requires the payload to be a JSON object), an
Per-byte decompression loop without a top-of-loop input bound: the input is indexed and decompressed one element at a time across its entire length, while the recovery/input-length guard either runs only on the error path (inside an `except` handler) or is absent. When the bytes decode without raising zlib.error (e.g. zlib.decompressobj() auto-detects a gzip
$BUF is read at $BUF[$IDX] before the "at least one byte remaining" guard `if (*$LEN < 1)` executes. When a caller passes a zero remaining length the guard correctly rejects the input, but the load of $BUF[0] has already happened one byte past the end of the buffer, producing a one-byte out-of-bounds read (CWE-125) on attacker-controlled parser input such as
The sandbox->host Proxy apply trap hands a host function's return value to the sandbox via thisFromOther($RET) without first marking the value as handled at the boundary. When a host function returns a rejected host-realm Promise (an embedder async function, Promise.reject, events.once, ...) and sandbox code ignores the result (no .then/.catch/.finally), the
$FUNC terminates the whole process with exit($STATUS) when it rejects bytes deserialized from an in-memory payload (fmemopen'd buffer / FILE* stream). In a Redis module this code is reachable with attacker-controlled bytes via module commands (e.g. GRAPH.EFFECT), so one malformed payload kills the server instead of reporting an error; after a supervised rest
Database wipe is executed via `Artisan::call('db:wipe', ...)` before validating that the backup archive is a valid ZIP file. If the file is corrupt or invalid, this leads to irreversible data loss. Validate the archive using `ZipArchive` before wiping the database.
Request-part schema presence (body/headers/querystring/params/query) is tested with JavaScript truthiness instead of an explicit `undefined` check. JSON Schema (Draft 6+) defines the boolean `false` as a valid schema that rejects every instance, so a deny-all schema such as `body: false` evaluates falsy, the validation-compilation branch is skipped, no valid
Unchecked indexing into the result of metadata.MD.Get() can trigger an out-of-bounds panic and crash the server if the client omits the header. Always verify that the slice is non-empty before accessing index 0.
Checking only the truthiness of `constructor.isBuffer` before invocation allows crafted objects with non-callable properties to trigger an unhandled TypeError. Verify that `typeof obj.constructor.isBuffer === 'function'` before calling it.
Calls to squashfs.Read on potentially untrusted squashfs images without panic recovery can cause a denial of service if malformed image headers trigger runtime panics in go-diskfs.
A length/size bound check fails open: the guard branch performs a bare `return` (or returns an explicit nil error) from a Go function with named results, so the named `err` stays nil and callers treat the rejected, un-consumed input as successfully parsed. In protocol parsers this desynchronizes the stream: a declared size above the representable maximum lea
Object parameter decoding iterates over schema properties without validating incoming parameter keys against allowed properties when additionalProperties is disabled, or performs unchecked type assertions on parameter maps.
Post-mount hooks are executed without verifying if the mount helper or syscall failed, allowing post-mount operations to run on pre-existing target mount points.
Fail-open security validation: $FUNC silently returns when dependency availability flag $AVAILABLE is false, so a missing optional library (e.g. jsonschema) turns this schema/security check into a no-op and callers accept unvalidated data as valid (CVE-2026-74875 pattern). Fail closed instead: raise a validation error when the check cannot run, and report th
Missing `check_no_metavar_no_fvar` check on declaration value before type checking. Opaque or definition declarations containing unvalidated free variables or metavariables can bypass kernel soundness checks via type checker cache lookup.
Calling `.unwrap()` or `.expect()` on `GeneralizedTime::from_system_time` or `UtcTime::from_system_time` can cause an unhandled panic and denial-of-service if the timestamp falls outside the ASN.1 supported range (e.g., 1970-9999). Propagate or handle the `Result` instead.
Calling .First() throws an InvalidOperationException when no item is found, making subsequent null checks unreachable and causing unhandled exceptions. Use .FirstOrDefault() instead.
Node-style response-error callback treats every request error as a fatal transport outage: inside an error-first callback, an `if (err ...)` branch calls $TEARDOWN(...) without first classifying server-originated ServiceFaults via the error's response.responseHeader.serviceResult. A protocol-level fault on a still-valid session/channel (e.g. BadInvalidTimest
Ineffective regex validation: this loop compiles a fixed expression instead of the range value $V, so every iteration re-checks the same hard-coded regex and the other values collected in $REGEXES are never validated. A malformed regex can be accepted and persisted and may later reach regexp.MustCompile and panic the process (denial of service). Compile the
Unsafe property access on an object dictionary using an untrusted session ID without verifying own property existence can resolve inherited properties like `__proto__` or `constructor`, leading to denial of service or logic errors. Use `Object.hasOwn()`, `Object.prototype.hasOwnProperty.call()`, or a `Map`.
