Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
IAM policy inspection only checks standalone 'aws:iam/policy:Policy' resources, ignoring inline policies (RolePolicy, UserPolicy, GroupPolicy) and policy attachments. This allows administrator or unsafe policy definitions to bypass security guardrails.
Directly accessing 'StringLike' or 'StringEquals' on an AWS IAM Condition object ignores set-qualified operators (e.g., 'ForAnyValue:StringLike') and modifier suffixes (e.g., 'StringLikeIfExists'). Iterate over condition entries and normalize the operator base name instead.
Naive URN prefix matching using split('$')[0] and startsWith can lead to policy validation bypasses due to crafted resource names. Parse URN type hierarchies structurally and enforce property-level value bindings.
Matching a dynamic request to resolve its controller without verifying access against Symfony's AccessMapInterface or AuthorizationCheckerInterface can bypass path-based access_control security rules.
Missing authorization (current_user_can) or nonce check prior to dispatching external API requests based on request parameters.
Subscription notification batching in AshGraphql does not filter out notifications belonging to other tenants before grouping and processing events. In-memory authorization does not enforce multitenancy, leading to cross-tenant notification leaks.
Group-level authorization check uses `.some()` against permitted resources instead of requiring full containment with `.every()`. This may grant access to all resources in a group if any single resource matches.
Polkit's `unix-process` subject specification requires the `uid` field to be a signed 32-bit integer (`i32`, D-Bus type `i`). Passing an unsigned integer or converting `uid` without casting to `i32` causes Polkit to silently discard the UID and fall back to a racy `/proc` PID lookup, enabling PID reuse authorization bypasses (CVE-2026-78422).
Reading `non_interactive_mode` from caller-supplied arguments or kwargs allows prompts and untrusted callers to bypass human-in-the-loop confirmation gates for sensitive tool execution. Drive non-interactive mode through trusted environment variables or host configuration instead.
Report template selection or default template configuration does not validate client ownership, potentially allowing cross-client template access or assigning client-scoped templates globally.
Chaining `orWhere` at the top level of a query that uses tenant scoping (`where('company_id', ...)`) can bypass multi-tenant isolation due to SQL operator precedence (AND before OR). Group OR conditions inside a closure `->where(function ($query) { ... })` instead.
User confirmation email is resent without verifying if the user account is in a pending state or eligible for confirmation. This may allow unauthorized users to request confirmation tokens and potentially bypass approval workflows.
MCP stdio process spawned after validation without binding command and arguments to staged manifest hashes.
MCP stdio server spawned without staged root hash verification and authority validation.
Calling `validate_before_stdio_spawn` directly instead of preparing and binding the launch via `prepare_stdio_launch` creates a TOCTOU race condition where spawned executables or arguments may be manipulated between validation and execution.
Access control decisions or path checks should not use `HttpServletRequest.getRequestURI()` with substring or prefix matching methods like `contains()`, `startsWith()`, or `endsWith()`. Raw request URIs may include matrix parameters, path traversal tokens, or unnormalized prefixes that allow authentication and authorization bypass. Use container-normalized m
OAuth token generation expands repository scopes without filtering unaffiliated organization scopes against current user memberships, allowing revoked organization members to maintain access via token refresh grants.
Validating repository OAuth scopes using only string prefix matching (`String.starts_with?/2`) allows unauthorized access to arbitrary repositories. The principal's permissions must be verified against the specific repository.
REST controller verifies access permissions on the parent container rather than the specific topic item, potentially bypassing item-level access controls.
Applying boolean XOR negation directly to aggregate policy condition evaluation results (`eval(...) ^ negate`) with a boolean `for_all` flag bypasses proper quantifier set semantics. Push negation down into per-value quantifier evaluation instead.
Applying outer logical XOR negation (`^ negate`) to the aggregated output of set policy condition evaluations (`eval`/`eval_like`) with `for_all` boolean flags causes logic inversion under `ForAllValues:` and `ForAnyValue:` qualifiers. Negation should be pushed down into per-element predicate evaluations or handled with quantifier context.
The controller checks if a label is already present on a user-controlled resource (`$OBJ.Labels`) before applying inherited or mandatory controller labels. An attacker can supply pre-existing labels to bypass controller label assignments and gain unauthorized access or join arbitrary sets.
The payment deletion API endpoint checks for invoice deletion permissions ('facture', 'supprimer') instead of payment management permissions ('facture', 'paiement'). This allows unauthorized users with invoice delete rights to permanently delete payment records.
Certificate revocation checks authorization only on the requested certificate row without verifying all records sharing the same authority and serial identity.
