Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Falling back to plan.actions when token-based lookup from an internal store fails allows execution of unverified or forged actions. Ensure the token exists in the store and do not fall back to untrusted actions supplied in the plan object.
The application determines the client IP address by directly trusting the `X-Real-IP` or `X-Forwarded-For` HTTP headers and unconditionally falling back to `request.client.host`. Because these headers can be freely modified by clients, an attacker can supply spoofed IP addresses to bypass IP-based rate limiting, tracking, or authentication. Ensure requests a
Configuring dynamic security limits (e.g. MAX_SIZE) via environment variables can be dangerous if the script is tied to an execution context that allows arbitrary environment variable injection (e.g. SSH daemon configs passing SendEnv). Avoid relying on unverified environment variables for critical security constraints such as resource limits. Consider using
Trusting the `Host` header for security decisions is insecure because attackers can spoof it. Do not rely on `$request->getUri()->getHost()` to bypass authentication or signature checks.
Sensitive authentication secrets (such as MFA or TOTP secrets) should not be loaded from user-controlled request parameters. Falling back from a server-side session to a request object via '??' or '?:' allows an attacker to inject their own secret when the session variable is unset or expired, bypassing authentication phases (CVE-2026-28510). Retrieve such s
The application utilizes client-side logic (`get_version` or `VERSION`) to determine service installation state, interacting with a known-vulnerable version of `clash_verge_service_ipc` (CVE-2026-26422). Under this design, the overly permissive IPC endpoint lacks server-side authorization boundaries. Upgrade to clash_verge_service_ipc >= 2.0.27 and use `clas
Returning NextResponse.next() solely based on the presence of an HTTP header without validating its value can lead to authentication or authorization bypass. In middleware, this may allow malicious clients to bypass checks and spoof downstream identities. Verify the header value against a known secret or perform token validation before proceeding, and strip
HTTP forwarding headers X-Forwarded-For and X-Real-IP are client-controlled values that flow into a security-sensitive operation without trusted proxy validation. Any unauthenticated client can forge these headers to spoof their source IP, poison access logs, and bypass IP-based authorization checks (CVE-2025-66570 / CWE-290). Use the socket-level remote add
Relying on the 'Referer' header to grant access or determine trust context is insecure as it can be spoofed or sent automatically by a browser from malicious sites (e.g., via image src attributes or scripts). Use a strongly generated authorization token or API key instead (such as a Bearer token in the 'Authorization' header).
The `getlogin` function suffers from many bugs or unknown behaviors depending on the system. Often, it gives only the first 8 characters of the login name. The user currently logged in on the controlling TTY of our program does not necessarily mean it is the user who started the process. Use getpwuid(geteuid()) and extract the desired information instead. Fo
This function's return value should be treated as untrusted input as it could be modified by an attacker. Possible risks include: - The value being too large and causing buffer overflows - Files under the attacker's control being used maliciously - Files outside of an attacker's control becoming accessible, depending on access privileges.
This function is synonymous with `getenv("TMP")` and should be treated as untrusted input as it could be modified by an attacker. Possible risks include: - The value being too large and causing buffer overflows - Files under the attacker's control being used maliciously - Files outside of an attacker's control becoming accessible, depending on access privile
This function is synonymous with `getenv("HOME")` and should be treated as untrusted input as it could be modified by an attacker. Possible risks include: - The value being too large and causing buffer overflows - Files under the attacker's control being used maliciously - Files outside of an attacker's control becoming accessible, depending on access privil
