All pull requests

Pull requests

• feat(java): detect cross-item queue task submission without a permission check (CWE-862)

  #235·ai-anant opened Nov 10, 2026·

  ·

• feat(php): detect request content written into an executable PHP file (CWE-94)

  #234·ai-anant opened Nov 7, 2026·

  ·

• feat(java): detect glob-to-regex translation assembling '.*' fragments in a loop (CWE-1333)

  #233·ai-anant opened Nov 7, 2026·

  ·

• feat(php): detect REST permission callback verifying nonce only when supplied (CWE-863)

  #232·ai-anant opened Nov 5, 2026·

  ·

• feat(javascript): detect HTML sanitiser allow-list permitting inline event-handler attributes (CWE-79)

  #231·ai-anant opened Nov 4, 2026·

  ·

• feat(java): detect fixed-name temp-directory paths liable to symlink follow (CWE-377/59)

  #230·ai-anant opened Nov 1, 2026·

  ·

• feat(php): detect email header injection via wp_mail()/mail() (CWE-93)

  #229·ai-anant opened Oct 31, 2026·

  ·

• feat(java): detect remote path concatenated into a WebDAV/HTTP client URL (CWE-22)

  #228·ai-anant opened Oct 30, 2026·

  ·

• feat(php): detect captcha verification passing when the token is missing (CWE-693)

  #227·ai-anant opened Oct 30, 2026·

  ·

• feat(java): detect credential picker populated under the system identity (CWE-863/639)

  #226·ai-anant opened Oct 30, 2026·

  ·

• feat(java): detect runtime secret written as a template parameter default value (CWE-312/522)

  #225·ai-anant opened Oct 29, 2026·

  ·

• feat(php): detect server-side template injection via request-controlled template source (CWE-94)

  #224·ai-anant opened Oct 29, 2026·

  ·

• feat(java): detect authentication filter released on mere presence of a request header (CWE-287)

  #223·ai-anant opened Oct 26, 2026·

  ·

• feat(php): detect payment/webhook callback completing an order without signature verification (CWE-345)

  #222·ai-anant opened Oct 25, 2026·

  ·

• feat(javascript): detect DOM URL sinks fed by network response data without scheme validation (CWE-601/79/918)

  #221·ai-anant opened Oct 24, 2026·

  ·

• feat(php): detect unsafe deserialization of a stored database column (CWE-502)

  #220·ai-anant opened Oct 23, 2026·

  ·

• feat(php): detect arbitrary file write via request-controlled destination (CWE-22/73)

  #219·ai-anant opened Oct 22, 2026·

  ·

• feat(bash): detect sourcing of a workspace-resolved config file (CWE-94)

  #218·ai-anant opened Oct 16, 2026·

  ·

• feat(python): detect SSH host-key verification disabled (CWE-322)

  #217·ai-anant opened Oct 7, 2026·

  ·

• feat(java): detect non-literal value used as the regex argument of String.replaceFirst/replaceAll/matches (CWE-625)

  #216·ai-anant opened Oct 6, 2026·

  ·

• feat(java): detect raw exception message reflected in a form-validation response (CWE-209)

  #215·ai-anant opened Oct 2, 2026·

  ·
  1

• feat(php): detect arbitrary file/directory deletion via request-controlled path (CWE-22)

  #214·ai-anant opened Oct 1, 2026·

  ·

• feat(java): detect unconditional CloudFormation IAM capability grant (CWE-269)

  #213·ai-anant opened Sep 29, 2026·

  ·

• feat(java): detect decrypted secret-store value injected into build environment unmasked (CWE-532)

  #212·ai-anant opened Sep 29, 2026·

  ·

• feat(php): detect PHP object injection via base64-encoded request/shortcode data (CWE-502)

  #211·ai-anant opened Sep 28, 2026·

  ·