Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Path-based authorization rules are evaluated against a potentially rebased path without resolving it back to the expected original absolute scope. This can cause deny rules to be silently bypassed if the filesystem root is unexpectedly changed (e.g., in a public directory share).
Missing CSRF middleware or proper authorization scope validation on Gin router setup.
The single-argument constructor of `FactoryFinder` creates an insecure factory that instantiates classes via reflection without validating their type or origin. If user-controlled input determines the loaded class, this can lead to arbitrary code execution and initialization-based authorization bypass. Upgrade to the patched ActiveMQ version and use the thre
`form.instance.FIELD` always holds the pre-submission value of the bound instance because Django ModelForm.is_valid() never mutates the instance. When `form = SomeForm(data=request.POST, instance=obj)`, then `form.instance` IS `obj`, so `obj.FIELD != form.instance.FIELD` is a tautological comparison that is permanently False. Any email-verification, change-d
Incomplete authorization enforcement for workflowTemplateRef restriction mode: only HasPodSpecPatch() is validated, leaving hostNetwork, serviceAccountName, securityContext, tolerations, automountServiceAccountToken, volumes, and other security-sensitive WorkflowSpec fields unchecked before the spec merge. A user with workflow-create permission can inject th
Affirmative use of createRouteMatcher — `if ($MATCHER(req)) { await auth.protect(); }` — is the vulnerable shape for CVE-2026-41248. In @clerk/shared versions before 2.22.1 / 3.47.4 / 4.8.1 the matcher compared the raw pathname without URL normalization, so crafted requests (`/api/%61dmin/...`, `//api/admin/...`, `/api/foo/%2e%2e/admin/...`) skipped the matc
The authorization check evaluates permissions using the incorrect subject `:document` instead of `:collaborative_text`. In the `decidim-collaborative_texts` component, component-specific permission bounds explicitly match `:collaborative_text`. Using `:document` bypasses expected authorization checks, which can lead to a fail-closed DoS or privilege escalati
Endpoint Security cache was not cleared after starting the adapter with initial rules. This can lead to cached, permissive access decisions incorrectly bypassing enforced rules across the system.
Authorization guard combines multiple '!==' inequality checks with '&&' (AND) before throwing an exception. Because '&&' requires ALL conditions to be true simultaneously, an attacker who satisfies even one check can bypass the guard entirely. Replace '&&' with '||' so that any single mismatch triggers rejection and unauthorized access is prevented. (CVE-202
A Fastify path-normalization option (ignoreDuplicateSlashes, ignoreTrailingSlash, or useSemicolonDelimiter) is read from a nested sub-configuration object without a nullish-coalescing (??) fallback to the parent/top-level configuration. In @fastify/middie, this causes the middleware path-matching engine to apply different URL normalization than Fastify's rou
Access rule matching is performed against an http.Request URL whose path has not been normalized via path.Clean. A request such as "/public/../admin/secrets" will have its raw path matched against rules, so a permissive wildcard rule (e.g. "/public/<.*>") may absorb the "../" segments and bypass the protected rule that governs the resolved path ("/admin/secr
The code assigns `True` to an ORM query clause when a parameter equals "all", effectively bypassing record-specific filtering. If not properly guarded by an authorization check verifying the user has global read access, this allows attackers to access restricted records. Validate user permissions or filter against an explicit list of allowed records instead
Call to model.FullTextSearchBlock() inside a gin.Context handler without an `if method == 2 && !model.IsAdminRoleContext(c)` admin gate. When the `method` parameter is 2, FullTextSearchBlock forwards the user-supplied query string to searchBySQL → db.Query(), executing arbitrary SQL against the SQLite database. Without an admin role check, any authenticated
VS-mode (cpu.v == 1) access to the supervisor interrupt CSRs sie/sip is being dispatched through vmode_get_sie / vmode_set_sie / vmode_get_sip / vmode_set_sip. These helpers do not apply the RISC-V H-extension delegation masking (get_hideleg() & (mideleg | MIDELEG_FORCED_MASK), hvien) and write directly to machine-level mie / hvip, which violates the privile
Detected an inets `mod_alias`-style alias lookup that calls httpd_util:multi_lookup(ConfigDB, alias) without also concatenating httpd_util:multi_lookup(ConfigDB, script_alias). This is the vulnerable shape of `which_alias/1` from CVE-2026-28808: mod_auth derives the filesystem path used for `<Directory>` access-control matching from this list, so omitting `s
GetWorkflowTemplate / GetClusterWorkflowTemplate handler reads a template via the server-credentialed informer cache (getTemplateAndValidate) without calling auth.CanI(ctx, "get", ...) first. Because the informer is initialized with the Argo server's own service-account credentials, the cache read bypasses Kubernetes RBAC, so any caller (including a request
An OR condition combining a broad global attribute check with a specific user context check was detected. In TypeORM, mixing unscoped properties with user identifiers using an array `where: [...]` or `.orWhere()` evaluates as an OR operator. This exposes all records matching the global attribute regardless of ownership, resulting in an Insecure Direct Object
Call to CodeChecker permissions helper (`require_permission`, `require_manager`, or `has_permission`) does not pass the `is_auth_enabled` flag. With a missing flag, these helpers short-circuit to True when `auth_session` is None, granting anonymous callers full authorization for permission-management RPCs reachable via the `/Authentication` Thrift endpoint (
The method 'getURL' or 'getSourceURL' declares '$grant = true' as the default parameter value. This automatically grants session-based access to protected assets for any caller that omits the argument, bypassing file permission checks entirely. Change the default to '$grant = false' so that access grants are an explicit, opt-in decision by callers rather tha
FindContainer wrapper accepts a `container.ContainerLabels` authorization scope but forwards only the container ID to the delegated `FindContainer` call, silently dropping label-based access control. A label-restricted user can then resolve any container ID on the agent host, bypassing tenant/scope isolation (CVE-2026-24740, CWE-863). Pass `labels` through t
Authorization bypass (IDOR) detected. The code fetches a target object and uses the target object's properties (e.g., role or privileges) for authorization, instead of the requester's context. An attacker can bypass access controls by explicitly calling the endpoint against an object that holds the privileged role. Verify that authorization checks evaluate t
The codebase incorrectly grants the full over-privileged `["api"]` scope whenever a permission's domain is `"api"`, completely ignoring the resource qualifier (such as `"read"`). This can lead to privilege escalation where a read-only API key is granted full write access. Map permissions correctly by taking resource qualifiers into account, or delegate to a
Direct property access or assignment to HTTP headers bypasses case-insensitivity mechanisms provided by structures like `AxiosHeaders` or `Fetch Headers`. This can cause critical headers (like 'Authorization' or 'Cache-Control') to be incorrectly extracted or overwritten, potentially leading to cache poisoning, authorization bypasses, or data leaks. Use `.ge
A function intended to perform a subset check uses `.some()` instead of `.every()`. A subset check requires that all elements of the first set exist in the second set (logical AND). Using `.some()` changes this to an intersection check (logical OR). In access control logic, missing this distinction can lead to security bypasses (e.g., CVE-2025-64530) by allo
