Rule Explorer

Non-atomic single-use token (nonce) check: a replayed value is rejected with a SELECT (`->count()` / `->exists()`), but the token itself is only INSERTed later through a separate write. Concurrent requests replaying the same SAML assertion all run the SELECT before any sibling request commits its INSERT, so every request passes the guard and mints an authent

PHPLaravelCVE-2026-116201CWE-294CWE-367CWE-837

Order settlement creates the order document directly inside a request-driven payment confirmation flow without an atomic exactly-once claim on the associated transaction. Because the settlement create runs inside a request context (req) after only a payment-provider status check, any replayed or concurrent confirm request that resolves the same client-suppli

TSCVE-2026-105850CWE-362CWE-837