IndexedVerified
Python Web Security
Django, Flask, and FastAPI SAST rules aggregated across verified providers.
Fetch pack
greprules pack fetch python-web-security --engine opengrepcurl https://api.greprules.io/api/packs/python-web-security.tar.gz -o python-web-security.tar.gz- Owner
- Provally
- Total rules
- 34
- Downloads
- 2
- Last updated
- 2026-06-29
- Languages
Python
Included rules
CVE-2026-45365: Fastapi Internal Auth Bypass Flag As Query Param
cve-2026-45365-fastapi-internal-auth-bypass-flag-as-query-paramCVE-2026-45315: Fastapi Fileresponse Path Route Missing Protection Headerscve-2026-45315-fastapi-fileresponse-path-route-missing-protection-headersCVE-2026-44796: Django Python Re Redoscve-2026-44796-django-python-re-redosCVE-2026-42999: Flask Dict Update Mass Assignmentcve-2026-42999-flask-dict-update-mass-assignmentCVE-2026-42864: Drf Allowany On Serializer Bound Viewcve-2026-42864-drf-allowany-on-serializer-bound-viewCVE-2026-42196: Python Pureposixpath Traversal Without Clean Namecve-2026-42196-python-pureposixpath-traversal-without-clean-nameCVE-2026-40525: Python Auth Fail Open Empty Api Keycve-2026-40525-python-auth-fail-open-empty-api-keyCVE-2026-39422: Django Response Unescaped Replace Xsscve-2026-39422-django-response-unescaped-replace-xssCVE-2026-35508: Django Safestring Unescaped Interpolationcve-2026-35508-django-safestring-unescaped-interpolationCVE-2026-33212: Celery Task Pending State Missing Authorizationcve-2026-33212-celery-task-pending-state-missing-authorizationCVE-2026-33076: Python Path Traversal Fstring Host Param Unvalidatedcve-2026-33076-python-path-traversal-fstring-host-param-unvalidatedCVE-2026-33057: Python Flask Request Code Executioncve-2026-33057-python-flask-request-code-executionCVE-2026-33017: Langflow Public Build Rce Via Data Paramcve-2026-33017-langflow-public-build-rce-via-data-paramCVE-2026-25873: Python Pickle Loads On Http Request Bodycve-2026-25873-python-pickle-loads-on-http-request-bodyCVE-2026-25117: Flask Csrf Bypass With Session Authcve-2026-25117-flask-csrf-bypass-with-session-authCVE-2026-24136: Django Missing File Upload Validationcve-2026-24136-django-missing-file-upload-validationCVE-2026-23846: Python Sensitive Query Paramcve-2026-23846-python-sensitive-query-paramCVE-2026-21892: Flask Pandas Sqlicve-2026-21892-flask-pandas-sqliCVE-2026-10042: Insecure Fastapi Pickle Deserializationcve-2026-10042-insecure-fastapi-pickle-deserializationCVE-2025-69201: Pydantic Unvalidated Command List Fieldcve-2025-69201-pydantic-unvalidated-command-list-fieldCVE-2025-64725: Weblate Invitation Post Missing Recipient Validationcve-2025-64725-weblate-invitation-post-missing-recipient-validationCVE-2025-53528: Fastapi Openapi Xss From Requestcve-2025-53528-fastapi-openapi-xss-from-requestCVE-2025-48383: Django Widget Shared Token Initcve-2025-48383-django-widget-shared-token-initCVE-2025-43863: Change Password Bruteforce No Rate Limitcve-2025-43863-change-password-bruteforce-no-rate-limit24 of 34 loaded