Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Ruby C extension method unwraps a Ruby object argument into a C struct without verifying its type via `rb_obj_is_kind_of`, potentially leading to type confusion and out-of-bounds memory access.
Values are heuristically coerced into numbers based on regex matching without validating the target property key. If a property (such as a string path) internally consists solely of numbers, it will be improperly parsed as a numeric type, leading to Type Confusion and potential Denial of Service when string operations are applied downstream. Replace this heu
Unconditionally accessing GENERAL_NAME union fields as ASN1_STRING without checking the GeneralName type causes type confusion and out-of-bounds memory reads for non-string SAN types (e.g., otherName).
Unchecked type assertion to a cryptographic key type (e.g., `*rsa.PublicKey`). If the interface contains a different type (for instance, an ECDSA key returned by an external JWKS endpoint instead of RSA), the assertion will panic and cause a Denial of Service. Use the `value, ok := ...` idiom to safely assert types.
Handlebars precompiler concatenates user-controllable options (`opts.handlebarPath`, `opts.commonjs`, `opts.namespace`) directly into generated JavaScript source code without escaping, and emits the result via `SourceNode.add(...)`. CVE-2026-33937: an attacker who controls these options (or, more broadly, who can supply a fake AST whose literal `value` field
During nested structure parsing, the code determines whether to instantiate an array or object purely by looking ahead at the next key using `Number.isNaN` or `isNaN`. This logic allows an attacker to mix array-index and object-property keys on the same path, tricking the parser into instantiating an array and subsequently injecting arbitrary properties on i
mci_check_login() declares its username/password parameters without a string type declaration. PHP's SOAP server delivers parameters using the XML schema type sent by the client (e.g. xsi:type="xsd:integer" arrives as a native PHP int). Without `?string`/`string` typing, an attacker can force the password to arrive as an integer, bypassing null-only normaliz
Property key $KEY is used in a hasOwnProperty() security check and then in a computed property access without first coercing it to a string primitive. A non-primitive $KEY implementing toString() or [Symbol.toPrimitive] can return different values on successive evaluations — an allowed name during the hasOwnProperty check and a dangerous key ('__proto__', 'c
Comparing JSON input arrays against a collection of string literals using set intersection causes a type mismatch bypass if the JSON contains numbers. JSON preserves integer types, resulting in empty intersections when integers are checked against string literals, potentially bypassing authorization checks. Cast the JSON elements to the appropriate type befo
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
A function meant to escape characters iterates over input without enforcing that the input is a string. If an attacker passes a list or dict of strings, the loop will iterate over the string chunks rather than individual characters. This bypasses character-level bounds checks (e.g., `c < '0'`) and results in injection vulnerabilities due to type confusion. V
A TPM signature structure is accessed for HMAC operations (reading `any.hashAlg` and accessing `hmac.digest`) without validating that the signature algorithm tag (`sigAlg`) is actually `TPM_ALG_HMAC`. This can lead to an out-of-bounds memory read due to union type confusion. Always verify the signature algorithm type.
A hardcoded, incomplete list of strings (like `-----BEGIN PUBLIC KEY-----`) is used to prevent asymmetric keys from being used as HMAC secrets. This can lead to algorithm confusion vulnerabilities if unhandled key types (e.g., OpenSSH ECDSA) are provided, allowing attackers to forge tokens. Use robust key parsing and format validation instead of string block
