{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.279537Z","repo":{"ref":{"host":"github.com","owner":"XiaomingX","name":"data-cve-poc-py-v1"},"default_branch":"main","clone_url":"https://github.com/XiaomingX/data-cve-poc-py-v1.git","html_url":"https://github.com/XiaomingX/data-cve-poc-py-v1","description":"这个仓库收集了所有在 GitHub 上能找到的 CVE 漏洞利用工具。 This repository collects all CVE exploits found on GitHub.","stars":49,"forks":10,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":35548,"primary_language":"Python","license_spdx":null,"created_at":"2026-02-01T03:41:41Z","pushed_at":"2026-11-14T05:39:24Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-09-05T03:35:57Z","owner_type":"User","release_assets":[]}},"commit_sha":"022616bacf6f9d441812532ec51086faa1bb30c1","profile":{"lines_by_language":{"Python":277698,"C":27658,"Shell":12025,"JavaScript":5982,"C++":4352,"PHP":3917,"Go":2341,"Objective-C":1924,"PowerShell":1764,"TypeScript":1580,"Ruby":1348,"Swift":333,"SQL":280,"Rust":250,"Java":112,"C#":36},"files_by_category":{"docs":1896,"source":1326,"binary":168,"other":165,"config":137,"test":19,"generated":10,"vendored":1,"oversized":1},"source_lines":336927,"test_lines":4673},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.4724,"estimated_share":0.0,"ai_artifacts":2.0,"flagged_work_units":47.0,"flagged_releases":null,"style_index":2.311},"summary":"Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence)."},"quality":{"score":38.9,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":46.4,"duplication":49.4,"lint":18.4,"testing":38.2,"docs":40.0,"type_safety":40.3,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 26% of function code in complex or long functions; 12% duplicated lines. Weakest area: lint."},"security":{"score":27.7,"confidence":0.73,"coverage":0.86,"label":"poor","breakdown":{"secrets":1.4,"sast":54.9,"dependencies":null,"ci_actions":53.8,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 6 possible secret(s) in the tree, 0 only in history; 412 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":73.0,"checked":73.0,"missing":2.0,"recent":0.0,"lookup_errors":0.0},"findings":[{"rule_id":"registry.missing-package","severity":"high","message":"PyPI package 'subprocess' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register","path":"2025/CVE-2025-5781/requirements.txt","line":null,"fingerprint":"registry.missing-package:PyPI:subprocess"},{"rule_id":"registry.missing-package","severity":"high","message":"PyPI package 'xml.etree.ElementTree' does not exist on the public registry: a private package, a typo, or an invented (hallucinated) name that anyone could register","path":"2026/CVE-2026-21385/requirements.txt","line":null,"fingerprint":"registry.missing-package:PyPI:xml-etree-elementtree"}],"evidence":[{"kind":"missing-package","description":"PyPI: subprocess (declared in 2025/CVE-2025-5781/requirements.txt)","ref":"2025/CVE-2025-5781/requirements.txt","url":null,"weight":0.0},{"kind":"missing-package","description":"PyPI: xml.etree.ElementTree (declared in 2026/CVE-2026-21385/requirements.txt)","ref":"2026/CVE-2026-21385/requirements.txt","url":null,"weight":0.0}],"data":{"phantom":true},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":284.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":341237.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-02":{"loc":22829,"attributed_loc":0},"2026-03":{"loc":23230,"attributed_loc":0},"2026-04":{"loc":25656,"attributed_loc":0},"2026-05":{"loc":24899,"attributed_loc":0},"2026-06":{"loc":34264,"attributed_loc":0},"2026-07":{"loc":61995,"attributed_loc":0},"2026-08":{"loc":34535,"attributed_loc":0},"2026-09":{"loc":48307,"attributed_loc":0},"2026-10":{"loc":45655,"attributed_loc":0},"2026-11":{"loc":19867,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1788752707.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"2025/CVE-2025-54136/CLAUDE.md (claude-code configuration)","ref":"2025/CVE-2025-54136/CLAUDE.md","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-54136/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"2025/CVE-2025-54136/codex/AGENTS.md (generic-agent configuration)","ref":"2025/CVE-2025-54136/codex/AGENTS.md","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-54136/codex/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"2025/CVE-2025-54136/CLAUDE.md","added_at":1788752707},{"tool":"generic-agent","path":"2025/CVE-2025-54136/codex/AGENTS.md","added_at":1788752707}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":266.0,"flagged_units":47.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":337949.0,"flagged_loc":161212.0,"flagged_loc_share":0.47703055786524,"max_loc_per_hour":3082.0,"median_loc_per_hour":228.25,"pr_timed_units":0.0,"excluded_import_loc":3288.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"12,328 lines of first-party code in ~4.0h (3,082 lines/hour, 1 commit session)","ref":"c7d9de2be383a8659ab48c84131fd99825f133c1","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/c7d9de2be383a8659ab48c84131fd99825f133c1","weight":0.6},{"kind":"velocity-burst","description":"7,044 lines of first-party code in ~4.0h (1,761 lines/hour, 1 commit session)","ref":"e4a01918d4b1d532a5db68a17fea1eeb4ffa7935","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/e4a01918d4b1d532a5db68a17fea1eeb4ffa7935","weight":0.5283},{"kind":"velocity-burst","description":"6,422 lines of first-party code in ~4.0h (1,606 lines/hour, 1 commit session)","ref":"ffead547663c132af5a6a60dc91444e95315e31e","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/ffead547663c132af5a6a60dc91444e95315e31e","weight":0.48164999999999997},{"kind":"velocity-burst","description":"5,562 lines of first-party code in ~4.0h (1,390 lines/hour, 1 commit session)","ref":"d6f8cf93d71f14d593c6e9153a632a5f9f82fbdb","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/d6f8cf93d71f14d593c6e9153a632a5f9f82fbdb","weight":0.41715},{"kind":"velocity-burst","description":"5,359 lines of first-party code in ~4.0h (1,340 lines/hour, 1 commit session)","ref":"d0b69bec18c400cd80b06b6528c2633a70038715","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/d0b69bec18c400cd80b06b6528c2633a70038715","weight":0.401925},{"kind":"velocity-burst","description":"5,292 lines of first-party code in ~4.0h (1,323 lines/hour, 1 commit session)","ref":"18457e658b2a3e20e06fde037a3fd9abb53f813a","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/18457e658b2a3e20e06fde037a3fd9abb53f813a","weight":0.3969},{"kind":"velocity-burst","description":"4,688 lines of first-party code in ~4.0h (1,172 lines/hour, 1 commit session)","ref":"077341445ebbfc36fd42beb1a6c554d27ee4d7d8","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/077341445ebbfc36fd42beb1a6c554d27ee4d7d8","weight":0.35159999999999997},{"kind":"velocity-burst","description":"4,661 lines of first-party code in ~4.0h (1,165 lines/hour, 1 commit session)","ref":"cf51080b74722cf9a9a2b100599503be07f4967b","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/cf51080b74722cf9a9a2b100599503be07f4967b","weight":0.34957499999999997},{"kind":"velocity-burst","description":"4,547 lines of first-party code in ~4.0h (1,137 lines/hour, 1 commit session)","ref":"e23213dce4a3b97246e5005f81f9e7e4cc6f7bb1","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/e23213dce4a3b97246e5005f81f9e7e4cc6f7bb1","weight":0.34102499999999997},{"kind":"velocity-burst","description":"4,460 lines of first-party code in ~4.0h (1,115 lines/hour, 1 commit session)","ref":"7b32b765ab7ea13a9e0727528ed0903b578c80f0","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/7b32b765ab7ea13a9e0727528ed0903b578c80f0","weight":0.33449999999999996},{"kind":"velocity-burst","description":"4,361 lines of first-party code in ~4.0h (1,090 lines/hour, 1 commit session)","ref":"7e0b3da7cf0996ca463ba7caa801f1ee347ceade","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/7e0b3da7cf0996ca463ba7caa801f1ee347ceade","weight":0.32707499999999995},{"kind":"velocity-burst","description":"4,138 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session)","ref":"794887e3d1abfd10f6c2a9a420bed3d49a8a55a3","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/794887e3d1abfd10f6c2a9a420bed3d49a8a55a3","weight":0.31034999999999996},{"kind":"velocity-burst","description":"4,004 lines of first-party code in ~4.0h (1,001 lines/hour, 1 commit session)","ref":"7089889a823894bc7707c7e2dd3d84f23ed68c47","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/7089889a823894bc7707c7e2dd3d84f23ed68c47","weight":0.30029999999999996},{"kind":"velocity-burst","description":"3,667 lines of first-party code in ~4.0h (917 lines/hour, 1 commit session)","ref":"cda38b925facd184e49715a9d2fba6733b331b87","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/cda38b925facd184e49715a9d2fba6733b331b87","weight":0.27502499999999996},{"kind":"velocity-burst","description":"3,399 lines of first-party code in ~4.0h (850 lines/hour, 1 commit session)","ref":"8370e944cbf22c7ae68c4b37df258bd3cc8fb53b","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/commit/8370e944cbf22c7ae68c4b37df258bd3cc8fb53b","weight":0.254925}],"data":{"flagged_loc_by_commit":{"6640025813ca6a9be8e63069e9b78fc3b8b2e899":2603,"d0b69bec18c400cd80b06b6528c2633a70038715":5359,"e4a01918d4b1d532a5db68a17fea1eeb4ffa7935":7044,"ee1bbd95e7424a9281e07b6900db64f26a224c48":2498,"225aac960f4ab3241a237186e69b06124cec09d7":2063,"2beb781689834f294d0710afcd671d517e654cb2":3040,"134531da48e4914162fc460dd66b35701d599958":2283,"d6f8cf93d71f14d593c6e9153a632a5f9f82fbdb":5562,"e23213dce4a3b97246e5005f81f9e7e4cc6f7bb1":4547,"bde367951cab2938a89e5549f2fbd27d7586add9":2507,"4ab09f2b2363371886579fae3016378d842f274d":2679,"7b2ffd37e0a5e01e75e028c3a5d913fa45a70a55":2071,"8370e944cbf22c7ae68c4b37df258bd3cc8fb53b":3399,"18457e658b2a3e20e06fde037a3fd9abb53f813a":5292,"cd392603cd0e1325e199bd78f2abc05e33926871":2624,"df5b1ea71fe21109be25bae3d1e6a6df529d1907":2088,"7089889a823894bc7707c7e2dd3d84f23ed68c47":4004,"b1ae915747da35fc12b0dec70033cf423ec5479f":2972,"2384dcccef665cfd62dafa8a075b204cad1f98e9":3116,"9cd45c8ff86fc94d27c6255a665548fbf0c1c23f":2132,"c7d9de2be383a8659ab48c84131fd99825f133c1":12328,"13ef3c8a269e0d05d238ad6cc660921ca8dfc12d":2731,"7e0b3da7cf0996ca463ba7caa801f1ee347ceade":4361,"2b831b026d65f01b543d8ff78b771c5324e3a6c0":2697,"bab2624106934eb84df72baab3761bb53e068dac":2448,"c63cdf366ddd90c4c51d1f3b0102372ecea23115":3111,"fa51811aea114fdf43f1ee6b5dc0d9975858f8fc":2144,"c860a20149eab4b433323f22f532714f6358d231":2010,"ea2a5d91eb337e71a1a588e8952700f86f7d4e0a":2881,"cd86342c64984d08c1d6c3632863a1ef44099568":2592,"d0affdbe787a8cee642292d2f24bbb4093c74f3e":2273,"cf51080b74722cf9a9a2b100599503be07f4967b":4661,"cda38b925facd184e49715a9d2fba6733b331b87":3667,"ca3be0014fb97fb5a26c45e59426ab46d859a240":3127,"077341445ebbfc36fd42beb1a6c554d27ee4d7d8":4688,"7bab4667d38452f2bc82c676a283fcb30a8c34d7":2107,"5774f822c8c579d3b934d3bd08c3cfed1323eddc":2691,"fd719dadfbf0e52a2f9bc5a80fd0679307f1f45d":2672,"da57f2944e8c0ca08444ecca378cf20c97b3892c":2344,"a69b6dfb2766437a658c3c0934f3cb52fdf8302d":2004,"88aae28a38c101caadb2c863d1a6ca956f41ab47":3263,"7b32b765ab7ea13a9e0727528ed0903b578c80f0":4460,"05358b8101e5aa532aa65523a82111b4dbec263c":2414,"ffead547663c132af5a6a60dc91444e95315e31e":6422,"794887e3d1abfd10f6c2a9a420bed3d49a8a55a3":4138,"1865b0573e123f4ad8979c2c637255486877b91d":2192,"022616bacf6f9d441812532ec51086faa1bb30c1":2903},"excluded_import_commits":["c0f95c79053b972a2d9159f6b0031ce18d9022a6"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":337264.0,"index":2.311,"count:narrated_steps":419.0,"per_kloc:narrated_steps":1.242,"files:narrated_steps":101.0,"count:placeholder":5.0,"per_kloc:placeholder":0.015,"files:placeholder":5.0,"count:emoji_in_code":697.0,"per_kloc:emoji_in_code":2.067,"files:emoji_in_code":72.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.003,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1: Create guest cart","ref":"2025/CVE-2025-20720/cve_2025_20720.py:242","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L242","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 2: Upload shell via cart item custom option","ref":"2025/CVE-2025-20720/cve_2025_20720.py:260","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L260","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 3: Find the uploaded shell","ref":"2025/CVE-2025-20720/cve_2025_20720.py:300","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L300","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 1: Create payload file","ref":"2025/CVE-2025-27591/exploit.sh:17","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-27591/exploit.sh#L17","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 2: Ensure log dir exists and is writable","ref":"2025/CVE-2025-27591/exploit.sh:21","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-27591/exploit.sh#L21","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 3: Remove log file if it exists","ref":"2025/CVE-2025-27591/exploit.sh:28","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-27591/exploit.sh#L28","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 4: Create symlink to /etc/passwd","ref":"2025/CVE-2025-27591/exploit.sh:33","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-27591/exploit.sh#L33","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # Step 5: Trigger sudo log write via `below`","ref":"2025/CVE-2025-27591/exploit.sh:37","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-27591/exploit.sh#L37","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":6.0,"secrets_history":0.0,"secrets_nonprod":35.0,"secrets_low_confidence":19.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2025/CVE-2025-0133/cve_2025_0133.py","line":29,"fingerprint":"2025/CVE-2025-0133/cve_2025_0133.py:generic-api-key:29"},{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"2025/CVE-2025-27636/README.md","line":97,"fingerprint":"2025/CVE-2025-27636/README.md:private-key:97"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2025/CVE-2025-20720/README.md","line":146,"fingerprint":"2025/CVE-2025-20720/README.md:generic-api-key:146"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2025/CVE-2025-31161/cve-2025-31161.py","line":45,"fingerprint":"2025/CVE-2025-31161/cve-2025-31161.py:generic-api-key:45"},{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"2025/CVE-2025-47423/README.md","line":44,"fingerprint":"2025/CVE-2025-47423/README.md:private-key:44"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2025/CVE-2025-48907/README.md","line":229,"fingerprint":"2025/CVE-2025-48907/README.md:generic-api-key:229"},{"rule_id":"gitleaks/pkcs12-file","severity":"high","message":"Possible pkcs12-file secret in the current tree","path":"2025/CVE-2025-69421/malformed-cve-2025-69421.p12","line":0,"fingerprint":"2025/CVE-2025-69421/malformed-cve-2025-69421.p12:pkcs12-file:0"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-1010/exploit_ws_smuggling.py","line":11,"fingerprint":"2026/CVE-2026-1010/exploit_ws_smuggling.py:generic-api-key:11"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2025/CVE-2025-60800/VULDB_REPORT.md","line":215,"fingerprint":"2025/CVE-2025-60800/VULDB_REPORT.md:generic-api-key:215"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-109506/crack.py","line":73,"fingerprint":"2026/CVE-2026-109506/crack.py:generic-api-key:73"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-109506/README.md","line":81,"fingerprint":"2026/CVE-2026-109506/README.md:generic-api-key:81"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-126997/README.md","line":66,"fingerprint":"2026/CVE-2026-126997/README.md:generic-api-key:66"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-12940/EVIDENCE.txt","line":10,"fingerprint":"2026/CVE-2026-12940/EVIDENCE.txt:jwt:10"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-13714/README.md","line":16,"fingerprint":"2026/CVE-2026-13714/README.md:generic-api-key:16"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-13714/CVE-2026-13714.py","line":13,"fingerprint":"2026/CVE-2026-13714/CVE-2026-13714.py:generic-api-key:13"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-16232/ReadMe.md","line":36,"fingerprint":"2026/CVE-2026-16232/ReadMe.md:generic-api-key:36"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-1814/r7creds.py","line":79,"fingerprint":"2026/CVE-2026-1814/r7creds.py:generic-api-key:79"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-21847/cve_poc_simple.py","line":18,"fingerprint":"2026/CVE-2026-21847/cve_poc_simple.py:generic-api-key:18"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-22038/README.md","line":102,"fingerprint":"2026/CVE-2026-22038/README.md:curl-auth-header:102"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-22038/README.md","line":68,"fingerprint":"2026/CVE-2026-22038/README.md:generic-api-key:68"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-21847/README.md","line":56,"fingerprint":"2026/CVE-2026-21847/README.md:generic-api-key:56"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-21847/dpdccve_scanner.py","line":221,"fingerprint":"2026/CVE-2026-21847/dpdccve_scanner.py:generic-api-key:221"},{"rule_id":"gitleaks/curl-auth-user","severity":"low","message":"Possible curl-auth-user secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-25232/README.md","line":57,"fingerprint":"2026/CVE-2026-25232/README.md:curl-auth-user:57"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-21847/security-report-dpdatacenter.md","line":57,"fingerprint":"2026/CVE-2026-21847/security-report-dpdatacenter.md:generic-api-key:57"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-28466/CVE-2026-28466.py","line":33,"fingerprint":"2026/CVE-2026-28466/CVE-2026-28466.py:generic-api-key:33"},{"rule_id":"gitleaks/age-secret-key","severity":"high","message":"Possible age-secret-key secret in the current tree","path":"2026/CVE-2026-29781/mtls_poc.go","line":60,"fingerprint":"2026/CVE-2026-29781/mtls_poc.go:age-secret-key:60"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"2026/CVE-2026-29781/mtls_poc.go","line":51,"fingerprint":"2026/CVE-2026-29781/mtls_poc.go:private-key:51"},{"rule_id":"gitleaks/jwt","severity":"high","message":"Possible jwt secret in the current tree","path":"2026/CVE-2026-30950/setup/setup.sh","line":44,"fingerprint":"2026/CVE-2026-30950/setup/setup.sh:jwt:44"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-30/exploit.py","line":96,"fingerprint":"2026/CVE-2026-30/exploit.py:generic-api-key:96"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-30944/README.md","line":175,"fingerprint":"2026/CVE-2026-30944/README.md:generic-api-key:175"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-32096/exploit.sh","line":58,"fingerprint":"2026/CVE-2026-32096/exploit.sh:generic-api-key:58"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-32255/internal-service.py","line":24,"fingerprint":"2026/CVE-2026-32255/internal-service.py:generic-api-key:24"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-30945/README.md","line":194,"fingerprint":"2026/CVE-2026-30945/README.md:generic-api-key:194"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-32255/README.md","line":150,"fingerprint":"2026/CVE-2026-32255/README.md:generic-api-key:150"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"2026/CVE-2026-32941/mtls_poc.go","line":55,"fingerprint":"2026/CVE-2026-32941/mtls_poc.go:private-key:55"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-35585/data/filebrowser.db","line":3,"fingerprint":"2026/CVE-2026-35585/data/filebrowser.db:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-42568/README.md","line":46,"fingerprint":"2026/CVE-2026-42568/README.md:generic-api-key:46"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-44578/README.md","line":33,"fingerprint":"2026/CVE-2026-44578/README.md:generic-api-key:33"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-46376/README.md","line":88,"fingerprint":"2026/CVE-2026-46376/README.md:generic-api-key:88"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"2026/CVE-2026-4660/Dockerfile","line":21,"fingerprint":"2026/CVE-2026-4660/Dockerfile:private-key:21"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-44825/README.md","line":280,"fingerprint":"2026/CVE-2026-44825/README.md:curl-auth-header:280"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-47670/README.md","line":42,"fingerprint":"2026/CVE-2026-47670/README.md:jwt:42"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-47670/README.md","line":45,"fingerprint":"2026/CVE-2026-47670/README.md:curl-auth-header:45"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-44578/verify_ghsa_c4j6.py","line":114,"fingerprint":"2026/CVE-2026-44578/verify_ghsa_c4j6.py:generic-api-key:114"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-39842/README.md","line":553,"fingerprint":"2026/CVE-2026-39842/README.md:curl-auth-header:553"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-55579/ANALYSIS.md","line":21,"fingerprint":"2026/CVE-2026-55579/ANALYSIS.md:generic-api-key:21"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-55579/EVIDENCE.md","line":94,"fingerprint":"2026/CVE-2026-55579/EVIDENCE.md:generic-api-key:94"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-55579/README.md","line":44,"fingerprint":"2026/CVE-2026-55579/README.md:generic-api-key:44"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-57517/cve_2026_57517.py","line":296,"fingerprint":"2026/CVE-2026-57517/cve_2026_57517.py:generic-api-key:296"},{"rule_id":"gitleaks/curl-auth-header","severity":"low","message":"Possible curl-auth-header secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-59734/README.md","line":177,"fingerprint":"2026/CVE-2026-59734/README.md:curl-auth-header:177"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-5465/README.md","line":168,"fingerprint":"2026/CVE-2026-5465/README.md:generic-api-key:168"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-56290/README.md","line":259,"fingerprint":"2026/CVE-2026-56290/README.md:generic-api-key:259"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-61628/CVE-2026-61628-Abraxas-Labs.py","line":236,"fingerprint":"2026/CVE-2026-61628/CVE-2026-61628-Abraxas-Labs.py:generic-api-key:236"},{"rule_id":"gitleaks/curl-auth-user","severity":"low","message":"Possible curl-auth-user secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-76904/README.md","line":115,"fingerprint":"2026/CVE-2026-76904/README.md:curl-auth-user:115"},{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-79551/README.md","line":89,"fingerprint":"2026/CVE-2026-79551/README.md:private-key:89"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-86259/README.md","line":51,"fingerprint":"2026/CVE-2026-86259/README.md:generic-api-key:51"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-89026/cve-2026-89026-issabel-pbxapi-jwt-rce.py","line":40,"fingerprint":"2026/CVE-2026-89026/cve-2026-89026-issabel-pbxapi-jwt-rce.py:generic-api-key:40"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"2026/CVE-2026-9198/README.md","line":55,"fingerprint":"2026/CVE-2026-9198/README.md:generic-api-key:55"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-9090/CVE-2026-9090.py","line":144,"fingerprint":"2026/CVE-2026-9090/CVE-2026-9090.py:generic-api-key:144"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"2026/CVE-2026-94609/CVE-2026-94609.py","line":161,"fingerprint":"2026/CVE-2026-94609/CVE-2026-94609.py:generic-api-key:161"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":965.0,"findings_high":412.0,"findings_medium":452.0,"findings_low":101.0,"weighted_findings":570.738,"scanned_lines":332959.0,"parse_errors":49.0},"findings":[{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-10042/52465.py","line":29,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-10042/52465.py:29"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-10585/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-10585/Dockerfile:21"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-11740/CVE-2025-11740.py","line":83,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-11740/CVE-2025-11740.py:83"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-11740/CVE-2025-11740.py","line":98,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-11740/CVE-2025-11740.py:98"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-11740/CVE-2025-11740.py","line":153,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-11740/CVE-2025-11740.py:153"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-12101/CVE_2025-12101.py","line":135,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-12101/CVE_2025-12101.py:135"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-13223/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-13223/Dockerfile:21"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-13407/CVE-2025-13407.py","line":117,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-13407/CVE-2025-13407.py:117"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-13407/CVE-2025-13407.py","line":144,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-13407/CVE-2025-13407.py:144"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-13407/CVE-2025-13407.py","line":168,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-13407/CVE-2025-13407.py:168"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2025/CVE-2025-1974/exploit.py","line":129,"fingerprint":"python.lang.security.unverified-ssl-context:2025/CVE-2025-1974/exploit.py:129"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2025/CVE-2025-1974/exploit.py","line":195,"fingerprint":"python.lang.security.unverified-ssl-context:2025/CVE-2025-1974/exploit.py:195"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2025/CVE-2025-1974/poc.py","line":190,"fingerprint":"python.lang.security.unverified-ssl-context:2025/CVE-2025-1974/poc.py:190"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-20720/cve_2025_20720.py","line":186,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-20720/cve_2025_20720.py:186"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-20720/cve_2025_20720.py","line":201,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-20720/cve_2025_20720.py:201"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-20720/cve_2025_20720.py","line":217,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-20720/cve_2025_20720.py:217"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-20720/cve_2025_20720.py","line":371,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-20720/cve_2025_20720.py:371"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-20720/cve_2025_20720.py","line":382,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-20720/cve_2025_20720.py:382"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-22224/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-22224/Dockerfile:21"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-22226/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-22226/Dockerfile:21"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-24472/exploit.py","line":85,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-24472/exploit.py:85"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-27509/exploit.py","line":137,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-27509/exploit.py:137"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-28137/mock/mock_totolink_a810r.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54"},{"rule_id":"opengrep/python.lang.security.dangerous-subprocess-use","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'. [confidence medium]","path":"2025/CVE-2025-28137/mock/mock_totolink_a810r.py","line":54,"fingerprint":"python.lang.security.dangerous-subprocess-use:2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2025/CVE-2025-28137/mock/mock_totolink_a810r.py","line":54,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2025/CVE-2025-28137/mock/mock_totolink_a810r.py:54"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-29009/CVE-2025-29009.py","line":140,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-29009/CVE-2025-29009.py:140"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-29009/CVE-2025-29009.py","line":183,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-29009/CVE-2025-29009.py:183"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-29009/CVE-2025-29009.py","line":237,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-29009/CVE-2025-29009.py:237"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-30208/CVE-2025-30208.py","line":130,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-30208/CVE-2025-30208.py:130"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-31125/exploit.py","line":48,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-31125/exploit.py:48"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-31125/exploit.py","line":64,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-31125/exploit.py:64"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-31131/exploit.py","line":45,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-31131/exploit.py:45"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-31324/PoC/PoC.py","line":25,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-31324/PoC/PoC.py:25"},{"rule_id":"opengrep/python.flask.security.insecure-deserialization","severity":"high","message":"Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON. [confidence low]","path":"2025/CVE-2025-32375/app.py","line":32,"fingerprint":"python.flask.security.insecure-deserialization:2025/CVE-2025-32375/app.py:32"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"2025/CVE-2025-38352/poc_gdb_script.py","line":113,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:2025/CVE-2025-38352/poc_gdb_script.py:113"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"2025/CVE-2025-38352/poc_gdb_script.py","line":118,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:2025/CVE-2025-38352/poc_gdb_script.py:118"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-39401/CVE-2025-39401.py","line":61,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-39401/CVE-2025-39401.py:61"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-39401/CVE-2025-39401.py","line":96,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-39401/CVE-2025-39401.py:96"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2025/CVE-2025-41450/code_of_day.py","line":43,"fingerprint":"python.lang.security.unverified-ssl-context:2025/CVE-2025-41450/code_of_day.py:43"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2025/CVE-2025-45422/cve-2025-45422.py","line":4,"fingerprint":"python.lang.security.use-defused-xml:2025/CVE-2025-45422/cve-2025-45422.py:4"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-47812/CVE-2025-47812.py","line":56,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-47812/CVE-2025-47812.py:56"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-47812/CVE-2025-47812.py","line":76,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-47812/CVE-2025-47812.py:76"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-47812/CVE-2025-47812.py","line":93,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-47812/CVE-2025-47812.py:93"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-49132/CVE-2025-49132-PoC.py","line":45,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-49132/CVE-2025-49132-PoC.py:45"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-49132/CVE-2025-49132-PoC.py","line":59,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-49132/CVE-2025-49132-PoC.py:59"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-49132/CVE-2025-49132-PoC.py","line":84,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-49132/CVE-2025-49132-PoC.py:84"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-49132/CVE-2025-49132-PoC.py","line":89,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-49132/CVE-2025-49132-PoC.py:89"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-54236/blabla.py","line":46,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-54236/blabla.py:46"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-54236/blabla.py","line":85,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-54236/blabla.py:85"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-54236/blabla.py","line":125,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-54236/blabla.py:125"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-54424/CVE-2025-54424.py","line":76,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-54424/CVE-2025-54424.py:76"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-5781/exploit.py","line":59,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-5781/exploit.py:59"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-5781/exploit.py","line":71,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-5781/exploit.py:71"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-5781/exploit.py","line":89,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-5781/exploit.py:89"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":56,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-57819/cve_2025_57819_aio.py:56"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":79,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-57819/cve_2025_57819_aio.py:79"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":95,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:2025/CVE-2025-57819/cve_2025_57819_aio.py:95"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":271,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-57819/cve_2025_57819_aio.py:271"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":286,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-57819/cve_2025_57819_aio.py:286"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":414,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:414"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":420,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:420"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":431,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:431"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":436,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:436"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":439,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:439"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":459,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:459"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'CompletedProcess' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":462,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:462"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":836,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:836"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":845,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:845"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":863,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:863"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":2518,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:2518"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-58726/ad-autopwn.py","line":2566,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-58726/ad-autopwn.py:2566"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-58726/cmc_addext.py","line":1253,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-58726/cmc_addext.py:1253"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-6254/CVE-2025-6254_exploit.py","line":43,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-6254/CVE-2025-6254_exploit.py:43"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-6254/CVE-2025-6254_exploit.py","line":59,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-6254/CVE-2025-6254_exploit.py:59"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-6254/CVE-2025-6254_exploit.py","line":103,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-6254/CVE-2025-6254_exploit.py:103"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-6254/CVE-2025-6254_exploit.py","line":157,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-6254/CVE-2025-6254_exploit.py:157"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-6554/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-6554/Dockerfile:21"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2025/CVE-2025-6558/Dockerfile","line":21,"fingerprint":"dockerfile.security.missing-user-entrypoint:2025/CVE-2025-6558/Dockerfile:21"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-66390/apim_signup.py","line":52,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-66390/apim_signup.py:52"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-66390/apim_signup.py","line":111,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-66390/apim_signup.py:111"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-66478/exploit.py","line":8,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-66478/exploit.py:8"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2025/CVE-2025-68645/CVE-2025-68645.py","line":56,"fingerprint":"python.requests.security.disabled-cert-validation:2025/CVE-2025-68645/CVE-2025-68645.py:56"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-68937/exploit.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-68937/exploit.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-68937/exploit.py","line":182,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-68937/exploit.py:182"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2025/CVE-2025-7441/CVE-2025-7441.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2025/CVE-2025-7441/CVE-2025-7441.py:87"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0001/smartermail_poc.py","line":42,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0001/smartermail_poc.py:42"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0651/exploit.py","line":94,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0651/exploit.py:94"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0651/lfd.py","line":33,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0651/lfd.py:33"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0740/shadow.py","line":31,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0740/shadow.py:31"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0740/shadow.py","line":72,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0740/shadow.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-0776/CVE-2026-0776.py","line":53,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-0776/CVE-2026-0776.py:53"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"2026/CVE-2026-0776/CVE-2026-0776.py","line":53,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:2026/CVE-2026-0776/CVE-2026-0776.py:53"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-0920/CVE-2026-0920.py","line":105,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-0920/CVE-2026-0920.py:105"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-104748/CVE-2026-104748.py","line":148,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-104748/CVE-2026-104748.py:148"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":382,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-105482/cve_2026_105482.py:382"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":426,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-105482/cve_2026_105482.py:426"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":443,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-105482/cve_2026_105482.py:443"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":636,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-105482/cve_2026_105482.py:636"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-10795/CVE-2026-10795-mass.py","line":121,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-10795/CVE-2026-10795-mass.py:121"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-108578/poc/poc_cve_2026_108578.py","line":239,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-108578/poc/poc_cve_2026_108578.py:239"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-108578/poc/poc_cve_2026_108578.py","line":303,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-108578/poc/poc_cve_2026_108578.py:303"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-109618/php2shell_check_v_1.0.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-109618/php2shell_check_v_1.0.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-110720/exploit.py","line":211,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-110720/exploit.py:211"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-110720/poc.py","line":185,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-110720/poc.py:185"},{"rule_id":"opengrep/javascript.express.security.express-vm-injection","severity":"high","message":"Make sure that unverified user data can not reach `vm`. [confidence medium]","path":"2026/CVE-2026-11114/sandbox_server.js","line":11,"fingerprint":"javascript.express.security.express-vm-injection:2026/CVE-2026-11114/sandbox_server.js:11"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-11120/cicd_build.py","line":7,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-11120/cicd_build.py:7"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'check_call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2026/CVE-2026-11120/cicd_build.py","line":7,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2026/CVE-2026-11120/cicd_build.py:7"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-111497/node2shell_inventory_scanner.py","line":169,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-111497/node2shell_inventory_scanner.py:169"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-11374/cve_2026_11374_check.py","line":124,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-11374/cve_2026_11374_check.py:124"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-11387/CVE-2026-11387.py","line":27,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-11387/CVE-2026-11387.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-114148/poc.py","line":240,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-114148/poc.py:240"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-114713/unrealircd_scanner.py","line":352,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-114713/unrealircd_scanner.py:352"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-114713/unrealircd_scanner.py","line":361,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-114713/unrealircd_scanner.py:361"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-11499/CVE-2026-11499.py","line":38,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-11499/CVE-2026-11499.py:38"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-115560/php2shell_check_v2.0.py","line":46,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-115560/php2shell_check_v2.0.py:46"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-116512/CVE-2026-116512.py","line":267,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-116512/CVE-2026-116512.py:267"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-116512/CVE-2026-116512.py","line":283,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-116512/CVE-2026-116512.py:283"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-116512/CVE-2026-116512.py","line":442,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-116512/CVE-2026-116512.py:442"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-116512/CVE-2026-116512.py","line":514,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-116512/CVE-2026-116512.py:514"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-116512/CVE-2026-116512.py","line":521,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-116512/CVE-2026-116512.py:521"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-117691/keycloak_saml_scanner.py","line":261,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-117691/keycloak_saml_scanner.py:261"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-121529/exploit.py","line":183,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-121529/exploit.py:183"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-121529/exploit.py","line":191,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-121529/exploit.py:191"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-121529/verifier.py","line":136,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-121529/verifier.py:136"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-123218/faspex_scanner.py","line":191,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-123218/faspex_scanner.py:191"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-123218/faspex_scanner.py","line":211,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-123218/faspex_scanner.py:211"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-123218/faspex_scanner.py","line":228,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-123218/faspex_scanner.py:228"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-129110/exploit-CVE-2026-129110.py","line":227,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-129110/exploit-CVE-2026-129110.py:227"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-129110/exploit-CVE-2026-129110.py","line":281,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-129110/exploit-CVE-2026-129110.py:281"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-13001/payload.php","line":55,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-13001/payload.php:55"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-13714/CVE-2026-13714.py","line":50,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-13714/CVE-2026-13714.py:50"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-13714/CVE-2026-13714.py","line":89,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-13714/CVE-2026-13714.py:89"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-13714/CVE-2026-13714.py","line":95,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-13714/CVE-2026-13714.py:95"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-13753/poc-min.py","line":107,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-13753/poc-min.py:107"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"2026/CVE-2026-14894/beelze.php","line":2,"fingerprint":"php.lang.security.eval-use:2026/CVE-2026-14894/beelze.php:2"},{"rule_id":"opengrep/php.lang.security.curl-ssl-verifypeer-off","severity":"high","message":"SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= false) [confidence medium]","path":"2026/CVE-2026-1492/CVE-2026-1492.php","line":39,"fingerprint":"php.lang.security.curl-ssl-verifypeer-off:2026/CVE-2026-1492/CVE-2026-1492.php:39"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-1555/CVE-2026-1555.py","line":194,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-1555/CVE-2026-1555.py:194"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-16232/CVE-2026-16232.py","line":23,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-16232/CVE-2026-16232.py:23"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-16232/CVE-2026-16232.py","line":247,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-16232/CVE-2026-16232.py:247"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-16232/CVE-2026-16232.py","line":314,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-16232/CVE-2026-16232.py:314"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-16232/CVE-2026-16232.py","line":331,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-16232/CVE-2026-16232.py:331"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-1657/CVE-2026-1657.py","line":22,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-1657/CVE-2026-1657.py:22"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-1657/CVE-2026-1657.py","line":57,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-1657/CVE-2026-1657.py:57"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-17543/Dockerfile","line":15,"fingerprint":"dockerfile.security.missing-user:2026/CVE-2026-17543/Dockerfile:15"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-18080/exploit.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-18080/exploit.py:51"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-18080/exploit.py","line":146,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-18080/exploit.py:146"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-18080/exploit.py","line":156,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-18080/exploit.py:156"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-1814/r7creds.py","line":55,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-1814/r7creds.py:55"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"2026/CVE-2026-1814/r7creds.py","line":128,"fingerprint":"python.lang.security.use-defused-xml-parse:2026/CVE-2026-1814/r7creds.py:128"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":510,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:510"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":647,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:647"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":649,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:649"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":664,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:664"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":666,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:666"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":690,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:690"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-18143/bp2.php","line":699,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-18143/bp2.php:699"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-19478/Dockerfile","line":20,"fingerprint":"dockerfile.security.missing-user:2026/CVE-2026-19478/Dockerfile:20"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":26,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-19949/CVE-2026-19949.py:26"},{"rule_id":"opengrep/python.django.security.injection.ssrf.ssrf-injection-requests","severity":"high","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium]","path":"2026/CVE-2026-2020/vulnerable_service.py","line":15,"fingerprint":"python.django.security.injection.ssrf.ssrf-injection-requests:2026/CVE-2026-2020/vulnerable_service.py:15"},{"rule_id":"opengrep/python.flask.security.injection.ssrf-requests","severity":"high","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium]","path":"2026/CVE-2026-2020/vulnerable_service.py","line":19,"fingerprint":"python.flask.security.injection.ssrf-requests:2026/CVE-2026-2020/vulnerable_service.py:19"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-20230/cve-2026-20230.py","line":29,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-20230/cve-2026-20230.py:29"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-20230/cve-2026-20230.py","line":57,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-20230/cve-2026-20230.py:57"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-20230/cve-2026-20230.py","line":91,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-20230/cve-2026-20230.py:91"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-20253/CVE-2026-20253.py","line":55,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-20253/CVE-2026-20253.py:55"},{"rule_id":"opengrep/python.jwt.security.jwt-python-none-alg","severity":"high","message":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm s [confidence medium]","path":"2026/CVE-2026-21003/exploit_jwt_none.py","line":5,"fingerprint":"python.jwt.security.jwt-python-none-alg:2026/CVE-2026-21003/exploit_jwt_none.py:5"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-21011/log4j_sim.py","line":12,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-21011/log4j_sim.py:12"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2026/CVE-2026-21011/log4j_sim.py","line":12,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2026/CVE-2026-21011/log4j_sim.py:12"},{"rule_id":"opengrep/php.lang.security.file-inclusion","severity":"high","message":"Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]","path":"2026/CVE-2026-21015/vulnerable.php","line":5,"fingerprint":"php.lang.security.file-inclusion:2026/CVE-2026-21015/vulnerable.php:5"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-21055/analyze_components.py","line":21,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-21055/analyze_components.py:21"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"2026/CVE-2026-21055/analyze_components.py","line":31,"fingerprint":"python.lang.security.use-defused-xml-parse:2026/CVE-2026-21055/analyze_components.py:31"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-21055/exploit.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-21055/exploit.py:43"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-21385/main.py","line":4,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-21385/main.py:4"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21440/CVE-2026-21440-code.py","line":19,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21440/CVE-2026-21440-code.py:19"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21440/CVE-2026-21440-code.py","line":45,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21440/CVE-2026-21440-code.py:45"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21440/CVE-2026-21440-code.py","line":52,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21440/CVE-2026-21440-code.py:52"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21440/CVE-2026-21440-code.py","line":60,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21440/CVE-2026-21440-code.py:60"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-21628/CVE-2026-21628.py","line":34,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-21628/CVE-2026-21628.py:34"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21643/cve_2026_21643.py","line":50,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21643/cve_2026_21643.py:50"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21643/cve_2026_21643.py","line":82,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21643/cve_2026_21643.py:82"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-21643/cve_2026_21643.py","line":88,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-21643/cve_2026_21643.py:88"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-21876/modsec_stand1/flask/Dockerfile","line":9,"fingerprint":"dockerfile.security.missing-user:2026/CVE-2026-21876/modsec_stand1/flask/Dockerfile:9"},{"rule_id":"opengrep/python.flask.security.dangerous-template-string","severity":"high","message":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks. [confidence low]","path":"2026/CVE-2026-21876/modsec_stand1/flask/app.py","line":49,"fingerprint":"python.flask.security.dangerous-template-string:2026/CVE-2026-21876/modsec_stand1/flask/app.py:49"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-22200/Dockerfile","line":46,"fingerprint":"dockerfile.security.missing-user-entrypoint:2026/CVE-2026-22200/Dockerfile:46"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"2026/CVE-2026-22241/evil.php","line":1,"fingerprint":"php.lang.security.exec-use:2026/CVE-2026-22241/evil.php:1"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"2026/CVE-2026-22241/evil.php","line":1,"fingerprint":"php.lang.security.injection.echoed-request:2026/CVE-2026-22241/evil.php:1"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"2026/CVE-2026-22241/evil.php","line":1,"fingerprint":"php.lang.security.tainted-exec:2026/CVE-2026-22241/evil.php:1"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-22557/CVE-2026-22557.py","line":51,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-22557/CVE-2026-22557.py:51"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-23744/exploit.py","line":27,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-23744/exploit.py:27"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-2413/CVE-2026-2413.py","line":35,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-2413/CVE-2026-2413.py:35"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-2461/CVE20262461.py","line":7,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-2461/CVE20262461.py:7"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2026/CVE-2026-2461/CVE20262461.py","line":7,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2026/CVE-2026-2461/CVE20262461.py:7"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"2026/CVE-2026-24841/靶场.py","line":236,"fingerprint":"javascript.lang.security.detect-insecure-websocket:2026/CVE-2026-24841/靶场.py:236"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-25089/CVE-2026-25089.py","line":59,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-25089/CVE-2026-25089.py:59"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-25676/exploit.py","line":77,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-25676/exploit.py:77"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"2026/CVE-2026-25676/exploit.py","line":77,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:2026/CVE-2026-25676/exploit.py:77"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-25746/exploit.py","line":4516,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-25746/exploit.py:4516"},{"rule_id":"opengrep/python.cryptography.security.crypto-mode-without-authentication","severity":"high","message":"An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. [confidence medium]","path":"2026/CVE-2026-26012/poc_decrypt.py","line":134,"fingerprint":"python.cryptography.security.crypto-mode-without-authentication:2026/CVE-2026-26012/poc_decrypt.py:134"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-26114/cve_2026_26114_rce.py","line":28,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-26114/cve_2026_26114_rce.py:28"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-26221/poc_cve_2026_26221.py","line":102,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-26221/poc_cve_2026_26221.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-26335/Calero VeraSMART-RCE.py","line":220,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-26335/Calero VeraSMART-RCE.py:220"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-26336/poc.py","line":32,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-26336/poc.py:32"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27174/scan.py","line":22,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27174/scan.py:22"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27626/CVE-2026.27626.py","line":37,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27626/CVE-2026.27626.py:37"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27626/CVE-2026.27626.py","line":56,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27626/CVE-2026.27626.py:56"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27636/CVE-2026-27636_PS.py","line":35,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27636/CVE-2026-27636_PS.py:35"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27876/CVE-2026-27876-check.py","line":30,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27876/CVE-2026-27876-check.py:30"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-27876/CVE-2026-27876-check.py","line":61,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-27876/CVE-2026-27876-check.py:61"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-27959/Dockerfile","line":11,"fingerprint":"dockerfile.security.missing-user:2026/CVE-2026-27959/Dockerfile:11"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"2026/CVE-2026-28466/CVE-2026-28466.py","line":31,"fingerprint":"javascript.lang.security.detect-insecure-websocket:2026/CVE-2026-28466/CVE-2026-28466.py:31"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-30225/exploit.py","line":64,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-30225/exploit.py:64"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-3180/dockerfile","line":30,"fingerprint":"dockerfile.security.missing-user-entrypoint:2026/CVE-2026-3180/dockerfile:30"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-32127/exploit3.py","line":4530,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-32127/exploit3.py:4530"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3228/CVE-2026-3228.py","line":484,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3228/CVE-2026-3228.py:484"},{"rule_id":"opengrep/python.django.security.injection.ssrf.ssrf-injection-requests","severity":"high","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium]","path":"2026/CVE-2026-3333/vulnerable_web_app.py","line":10,"fingerprint":"python.django.security.injection.ssrf.ssrf-injection-requests:2026/CVE-2026-3333/vulnerable_web_app.py:10"},{"rule_id":"opengrep/python.flask.security.injection.ssrf-requests","severity":"high","message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer secur [confidence medium]","path":"2026/CVE-2026-3333/vulnerable_web_app.py","line":15,"fingerprint":"python.flask.security.injection.ssrf-requests:2026/CVE-2026-3333/vulnerable_web_app.py:15"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-33715/poc.py","line":55,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-33715/poc.py:55"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"2026/CVE-2026-34200/exploit.ts","line":229,"fingerprint":"javascript.browser.security.insecure-document-method:2026/CVE-2026-34200/exploit.ts:229"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `entry.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"2026/CVE-2026-34200/exploit.ts","line":229,"fingerprint":"javascript.browser.security.insecure-innerhtml:2026/CVE-2026-34200/exploit.ts:229"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"2026/CVE-2026-34227/poc.ts","line":229,"fingerprint":"javascript.browser.security.insecure-document-method:2026/CVE-2026-34227/poc.ts:229"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `entry.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"2026/CVE-2026-34227/poc.ts","line":229,"fingerprint":"javascript.browser.security.insecure-innerhtml:2026/CVE-2026-34227/poc.ts:229"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-34724/check-CVE-2026-34724.py","line":22,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-34724/check-CVE-2026-34724.py:22"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-34908/cve_2026_34908_check.py","line":145,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-34908/cve_2026_34908_check.py:145"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-35273/CVE-2026-35273.py","line":92,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-35273/CVE-2026-35273.py:92"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-35273/CVE-2026-35273.py","line":94,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-35273/CVE-2026-35273.py:94"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":65,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:65"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":140,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:140"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":154,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:154"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":179,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:179"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":211,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:211"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3584/mass_scanner.py","line":271,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3584/mass_scanner.py:271"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3629/CVE-2026-3629.py","line":40,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3629/CVE-2026-3629.py:40"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3629/CVE-2026-3629.py","line":55,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3629/CVE-2026-3629.py:55"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3844/CVE-2026-3844.py","line":69,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3844/CVE-2026-3844.py:69"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3844/CVE-2026-3844.py","line":147,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3844/CVE-2026-3844.py:147"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-3888/cve_2026_3888_poc.py","line":136,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-3888/cve_2026_3888_poc.py:136"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3891/CVE-2026-3891.py","line":163,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3891/CVE-2026-3891.py:163"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-3891/CVE-2026-3891.py","line":225,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-3891/CVE-2026-3891.py:225"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-39987/CVE-2026-39987.py","line":30,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-39987/CVE-2026-39987.py:30"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-39987/CVE-2026-39987.py","line":43,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-39987/CVE-2026-39987.py:43"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"2026/CVE-2026-40176/poc.php","line":75,"fingerprint":"php.lang.security.exec-use:2026/CVE-2026-40176/poc.php:75"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-40179/cve-2026-40179-poc.py","line":84,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-40179/cve-2026-40179-poc.py:84"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-40281/CVE-2026-40281.py","line":173,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-40281/CVE-2026-40281.py:173"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-4112/sma_admin_hash_poc.py","line":624,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-4112/sma_admin_hash_poc.py:624"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-4112/sma_admin_hash_poc.py","line":638,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-4112/sma_admin_hash_poc.py:638"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"2026/CVE-2026-41490/poc/poc_partition_sqli.py","line":147,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:2026/CVE-2026-41490/poc/poc_partition_sqli.py:147"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"2026/CVE-2026-41490/poc/poc_partition_sqli.py","line":157,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:2026/CVE-2026-41490/poc/poc_partition_sqli.py:157"},{"rule_id":"opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query","severity":"high","message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]","path":"2026/CVE-2026-41490/poc/poc_partition_sqli.py","line":177,"fingerprint":"python.sqlalchemy.security.sqlalchemy-execute-raw-query:2026/CVE-2026-41490/poc/poc_partition_sqli.py:177"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":15,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:15"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":30,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:30"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":48,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:48"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":78,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:78"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":107,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:107"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41679/poc.py","line":133,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41679/poc.py:133"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-41940/check_session.py","line":30,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-41940/check_session.py:30"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-42208/litellm_scanner.py","line":47,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-42208/litellm_scanner.py:47"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-42208/litellm_scanner.py","line":59,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-42208/litellm_scanner.py:59"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-42588/CVE-2026-42588_EXP.py","line":160,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-42588/CVE-2026-42588_EXP.py:160"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-43503/CVE-2026-43503.py","line":63,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-43503/CVE-2026-43503.py:63"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2026/CVE-2026-43503/CVE-2026-43503.py","line":63,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2026/CVE-2026-43503/CVE-2026-43503.py:63"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44277/CVE-2026-44277.py","line":43,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44277/CVE-2026-44277.py:43"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44402/CVE-2026-44402.py","line":133,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44402/CVE-2026-44402.py:133"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44402/CVE-2026-44402.py","line":144,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44402/CVE-2026-44402.py:144"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44402/CVE-2026-44402.py","line":149,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44402/CVE-2026-44402.py:149"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44402/CVE-2026-44402.py","line":157,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44402/CVE-2026-44402.py:157"},{"rule_id":"opengrep/python.jwt.security.jwt-python-hardcoded-secret","severity":"high","message":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables) [confidence high]","path":"2026/CVE-2026-4444/exploit_jwt_kid.py","line":36,"fingerprint":"python.jwt.security.jwt-python-hardcoded-secret:2026/CVE-2026-4444/exploit_jwt_kid.py:36"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44825/solr_scanner.py","line":24,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44825/solr_scanner.py:24"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-44825/solr_scanner.py","line":91,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-44825/solr_scanner.py:91"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-44848/portainer_plugin_poc.py","line":19,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-44848/portainer_plugin_poc.py:19"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-45498/DefenderScanner.py","line":14,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-45498/DefenderScanner.py:14"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-45777/CVE-2026-45777.py","line":18,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-45777/CVE-2026-45777.py:18"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-46300/CVE-2026-46300.py","line":51,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-46300/CVE-2026-46300.py:51"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"2026/CVE-2026-46300/CVE-2026-46300.py","line":51,"fingerprint":"python.lang.security.audit.subprocess-shell-true:2026/CVE-2026-46300/CVE-2026-46300.py:51"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"2026/CVE-2026-46394/poc_git_cmdi.php","line":277,"fingerprint":"php.lang.security.exec-use:2026/CVE-2026-46394/poc_git_cmdi.php:277"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"2026/CVE-2026-46394/poc_git_cmdi.php","line":279,"fingerprint":"php.lang.security.exec-use:2026/CVE-2026-46394/poc_git_cmdi.php:279"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-48282/CVE-2026-48282.py","line":424,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-48282/CVE-2026-48282.py:424"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-48558/poc.py","line":31,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-48558/poc.py:31"},{"rule_id":"opengrep/python.jwt.security.jwt-python-hardcoded-secret","severity":"high","message":"Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables) [confidence high]","path":"2026/CVE-2026-48558/poc.py","line":73,"fingerprint":"python.jwt.security.jwt-python-hardcoded-secret:2026/CVE-2026-48558/poc.py:73"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-48732/poc.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-48732/poc.py:52"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49009/exploit.py","line":84,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49009/exploit.py:84"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49009/exploit.py","line":166,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49009/exploit.py:166"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":151,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:151"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":183,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:183"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":220,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:220"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":251,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:251"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":287,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:287"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-49777/CVE-2026-49777.py","line":331,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-49777/CVE-2026-49777.py:331"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5027/exploit.py","line":52,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5027/exploit.py:52"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5027/exploit.py","line":65,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5027/exploit.py:65"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5027/exploit.py","line":83,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5027/exploit.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-50369/reproducer.py","line":194,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:2026/CVE-2026-50369/reproducer.py:194"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"2026/CVE-2026-5173/CVE-2026-5173.py","line":14,"fingerprint":"javascript.lang.security.detect-insecure-websocket:2026/CVE-2026-5173/CVE-2026-5173.py:14"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"2026/CVE-2026-52806/gogs.py","line":89,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:2026/CVE-2026-52806/gogs.py:89"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-53571/poc.py","line":8,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-53571/poc.py:8"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"2026/CVE-2026-53587/CVE-2026-53587.py","line":26,"fingerprint":"python.lang.security.use-defused-xml:2026/CVE-2026-53587/CVE-2026-53587.py:26"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"2026/CVE-2026-54161/Dockerfile","line":10,"fingerprint":"dockerfile.security.missing-user:2026/CVE-2026-54161/Dockerfile:10"},{"rule_id":"opengrep/python.lang.security.unverified-ssl-context","severity":"high","message":"Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium]","path":"2026/CVE-2026-5430/cve_2026_5430_poc.py","line":150,"fingerprint":"python.lang.security.unverified-ssl-context:2026/CVE-2026-5430/cve_2026_5430_poc.py:150"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5524/CVE-2026-5524.py","line":123,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5524/CVE-2026-5524.py:123"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5524/CVE-2026-5524.py","line":181,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5524/CVE-2026-5524.py:181"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5524/CVE-2026-5524.py","line":241,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5524/CVE-2026-5524.py:241"},{"rule_id":"opengrep/python.requests.security.disabled-cert-validation","severity":"high","message":"Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. [confidence low]","path":"2026/CVE-2026-5524/CVE-2026-5524.py","line":267,"fingerprint":"python.requests.security.disabled-cert-validation:2026/CVE-2026-5524/CVE-2026-5524.py:267"}],"evidence":[],"data":{"rulesets":["python","c","bash","javascript","php","go","typescript","ruby","swift","rust","java","csharp","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"failed","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"osv-scanner exited 127: workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:4: unknown directive: # | workspace/runs/github.com/XiaomingX/data-cve-poc-py-v1/repo/2026/CVE-2026-42167/go.mod:5: go directive expects exactly one argument | extraction failed on specified lockfile"},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":4.0,"findings_high":3.0,"findings_medium":1.0,"findings_low":0.0,"penalty":37.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/actions.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/actions.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/actions.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/actions.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/actions.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/actions.yml:28"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/actions.yml","line":16,"fingerprint":"artipacked:.github/workflows/actions.yml:16"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":16.0},"findings":[],"evidence":[{"kind":"posture","description":"2025/CVE-2025-55319/extension/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2025/CVE-2025-55319/extension/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-102261/go.mod has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-102261/go.mod","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-11417/poc/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-11417/poc/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-13585/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-13585/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-21717/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-21717/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-21877/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-21877/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-27959/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-27959/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-30952/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-30952/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-40176/composer.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-40176/composer.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-42167/go.mod has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-42167/go.mod","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-46395/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-46395/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-46420/attacker/composer.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-46420/attacker/composer.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-46420/composer.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-46420/composer.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-46490/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-46490/package.json","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-77622/go.mod has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-77622/go.mod","url":null,"weight":0.3},{"kind":"posture","description":"2026/CVE-2026-85625/package.json has no lockfile alongside it (unpinned dependencies)","ref":"2026/CVE-2026-85625/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":9999.0,"function_nloc":194551.0,"mean_ccn":4.98,"p90_ccn":11.0,"complex_functions":549.0,"long_functions":160.0,"many_param_functions":104.0,"risky_nloc_share":0.2563},"findings":[],"evidence":[{"kind":"complex-function","description":"main in 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp: complexity 151, 906 lines","ref":"2025/CVE-2025-21333/CVE-2025-21333-POC.cpp","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-21333/CVE-2025-21333-POC.cpp#L892","weight":1.0},{"kind":"complex-function","description":"main in 2025/CVE-2025-58726/ad-autopwn.py: complexity 93, 213 lines","ref":"2025/CVE-2025-58726/ad-autopwn.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-58726/ad-autopwn.py#L8470","weight":1.0},{"kind":"complex-function","description":"wmain in 2026/CVE-2026-83991/main_poc.c: complexity 84, 361 lines","ref":"2026/CVE-2026-83991/main_poc.c","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-83991/main_poc.c#L682","weight":1.0},{"kind":"complex-function","description":"passive_sniff in 2025/CVE-2025-58726/ad-autopwn.py: complexity 83, 209 lines","ref":"2025/CVE-2025-58726/ad-autopwn.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-58726/ad-autopwn.py#L2787","weight":1.0},{"kind":"complex-function","description":"run in 2026/CVE-2026-25895/fuxapwn.py: complexity 83, 387 lines","ref":"2026/CVE-2026-25895/fuxapwn.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-25895/fuxapwn.py#L885","weight":1.0},{"kind":"complex-function","description":"main in 2026/CVE-2026-4961/src/patch_firmware_v5.py: complexity 82, 388 lines","ref":"2026/CVE-2026-4961/src/patch_firmware_v5.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-4961/src/patch_firmware_v5.py#L190","weight":1.0},{"kind":"complex-function","description":"main in 2026/CVE-2026-6516/cve-2026-6516-scanner.py: complexity 81, 201 lines","ref":"2026/CVE-2026-6516/cve-2026-6516-scanner.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-6516/cve-2026-6516-scanner.py#L1198","weight":1.0},{"kind":"complex-function","description":"print_summary in 2025/CVE-2025-58726/ad-autopwn.py: complexity 80, 164 lines","ref":"2025/CVE-2025-58726/ad-autopwn.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-58726/ad-autopwn.py#L7997","weight":1.0},{"kind":"complex-function","description":"change_password in 2026/CVE-2026-19632/CVE-2026-19632.py: complexity 77, 132 lines","ref":"2026/CVE-2026-19632/CVE-2026-19632.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-19632/CVE-2026-19632.py#L663","weight":1.0},{"kind":"complex-function","description":"check_target in 2026/CVE-2026-6516/cve-2026-6516-scanner.py: complexity 72, 141 lines","ref":"2026/CVE-2026-6516/cve-2026-6516-scanner.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2026/CVE-2026-6516/cve-2026-6516-scanner.py#L793","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":263242.0,"duplicated_lines":30983.0,"duplicated_share":0.1177,"files":1326.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-10585/poc.py:4 and 2025/CVE-2025-13223/poc.py:4","ref":"2025/CVE-2025-10585/poc.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-10585/poc.py#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-10897/CVE-2025-10897-X7.py:1 and 2026/CVE-2026-10520/CVE-2026-10520-X7.py:1","ref":"2025/CVE-2025-10897/CVE-2025-10897-X7.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-10897/CVE-2025-10897-X7.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-11201/poc.py:43 and 2025/CVE-2025-11201/poc.py:64","ref":"2025/CVE-2025-11201/poc.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-11201/poc.py#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-11740/CVE-2025-11740.py:81 and 2025/CVE-2025-6254/CVE-2025-6254_exploit.py:41","ref":"2025/CVE-2025-11740/CVE-2025-11740.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-11740/CVE-2025-11740.py#L81","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-1974/exploit.py:37 and 2025/CVE-2025-1974/poc.py:34","ref":"2025/CVE-2025-1974/exploit.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-1974/exploit.py#L37","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:77 and 2026/CVE-2026-15282/cve_2026_15282.py:65","ref":"2025/CVE-2025-20720/cve_2025_20720.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L77","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:89 and 2026/CVE-2026-13001/cve_2026_13001.py:140","ref":"2025/CVE-2025-20720/cve_2025_20720.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L89","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-20720/cve_2025_20720.py:108 and 2026/CVE-2026-54390/cve_2026_54390.py:76","ref":"2025/CVE-2025-20720/cve_2025_20720.py","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-20720/cve_2025_20720.py#L108","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:540 and 2025/CVE-2025-21333/wnf.h:204","ref":"2025/CVE-2025-21333/CVE-2025-21333-POC.cpp","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-21333/CVE-2025-21333-POC.cpp#L540","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:740 and 2025/CVE-2025-21333/CVE-2025-21333-POC.cpp:754","ref":"2025/CVE-2025-21333/CVE-2025-21333-POC.cpp","url":"https://github.com/XiaomingX/data-cve-poc-py-v1/blob/022616bacf6f9d441812532ec51086faa1bb30c1/2025/CVE-2025-21333/CVE-2025-21333-POC.cpp#L740","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1629.0,"weighted_findings":2252.0,"scanned_lines":332959.0,"category:best-practice":1271.0,"category:correctness":277.0,"category:maintainability":81.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-0282/exploit.py","line":131,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-0282/exploit.py:131"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-0282/exploit.py","line":162,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-0282/exploit.py:162"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-11142/poc.py","line":104,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-11142/poc.py:104"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-15177/exploit.py","line":112,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-15177/exploit.py:112"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-15177/exploit.py","line":130,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-15177/exploit.py:130"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-1974/exploit.py","line":615,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-1974/exploit.py:615"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-26466/poc.py","line":138,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-26466/poc.py:138"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-26466/poc.py","line":195,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-26466/poc.py:195"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-27840/scripts/esp32_undocumented_commands.py","line":181,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-27840/scripts/esp32_undocumented_commands.py:181"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-29009/CVE-2025-29009.py","line":354,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-29009/CVE-2025-29009.py:354"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-29384/poc.py","line":117,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-29384/poc.py:117"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-32044/cve_2025_32044.py","line":38,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-32044/cve_2025_32044.py:38"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-32044/cve_2025_32044.py","line":49,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-32044/cve_2025_32044.py:49"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-32433/CVE-2025-32433.py","line":91,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-32433/CVE-2025-32433.py:91"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-32433/CVE-2025-32433.py","line":97,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-32433/CVE-2025-32433.py:97"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-32433/CVE-2025-32433.py","line":103,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-32433/CVE-2025-32433.py:103"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-34071/PoC.py","line":168,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-34071/PoC.py:168"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-34071/PoC.py","line":178,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-34071/PoC.py:178"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-39401/CVE-2025-39401.py","line":105,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-39401/CVE-2025-39401.py:105"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-39401/CVE-2025-39401.py","line":130,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-39401/CVE-2025-39401.py:130"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-44203/exploit.py","line":63,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-44203/exploit.py:63"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"2025/CVE-2025-48907/CVE-2026-48907.py","line":181,"fingerprint":"python.lang.best-practice.open-never-closed:2025/CVE-2025-48907/CVE-2026-48907.py:181"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-48932/exploit.py","line":201,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-48932/exploit.py:201"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-48932/exploit.py","line":342,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-48932/exploit.py:342"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-48932/exploit.py","line":385,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-48932/exploit.py:385"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-48932/exploit.py","line":604,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-48932/exploit.py:604"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-5781/exploit.py","line":69,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-5781/exploit.py:69"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":217,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-57819/cve_2025_57819_aio.py:217"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-57819/cve_2025_57819_aio.py","line":278,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-57819/cve_2025_57819_aio.py:278"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":1280,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:1280"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":1321,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:1321"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":1933,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:1933"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":1949,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:1949"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":2173,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:2173"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":3184,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:3184"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":3221,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:3221"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":3441,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:3441"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":3489,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:3489"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":4641,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:4641"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5074,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5074"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5108,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5108"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5454,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5454"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5500,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5500"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5612,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5612"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-58726/ad-autopwn.py","line":5643,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-58726/ad-autopwn.py:5643"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6000/CVE-2025-6000.py","line":355,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6000/CVE-2025-6000.py:355"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6000/CVE-2025-6000.py","line":381,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6000/CVE-2025-6000.py:381"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6000/CVE-2025-6000.py","line":386,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6000/CVE-2025-6000.py:386"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6000/CVE-2025-6000.py","line":388,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6000/CVE-2025-6000.py:388"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6000/CVE-2025-6000.py","line":438,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6000/CVE-2025-6000.py:438"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-62593/ray_rce_poc.py","line":127,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-62593/ray_rce_poc.py:127"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-63408/path-traversal.py","line":77,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-63408/path-traversal.py:77"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6440/poc-exploit.py","line":72,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6440/poc-exploit.py:72"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-6440/poc-exploit.py","line":207,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-6440/poc-exploit.py:207"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-66034/varlib_cve_2025_66034.py","line":210,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-66034/varlib_cve_2025_66034.py:210"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-68645/CVE-2025-68645.py","line":29,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-68645/CVE-2025-68645.py:29"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-68937/exploit.py","line":156,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-68937/exploit.py:156"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-68937/exploit.py","line":258,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-68937/exploit.py:258"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2025/CVE-2025-69212/CVE-2025-69212.py","line":25,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2025/CVE-2025-69212/CVE-2025-69212.py:25"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0009/poc_path_traversal.py","line":154,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0009/poc_path_traversal.py:154"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0009/poc_path_traversal.py","line":172,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0009/poc_path_traversal.py:172"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0014/input-leap-directory-traversal-poc.py","line":318,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0014/input-leap-directory-traversal-poc.py:318"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'cf.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'cf.name' is used. Use '.flush()' or close the file before using 'cf.name'.","path":"2026/CVE-2026-0073/adb_tls_auth_bypass.py","line":221,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-0073/adb_tls_auth_bypass.py:221"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'kf.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'kf.name' is used. Use '.flush()' or close the file before using 'kf.name'.","path":"2026/CVE-2026-0073/adb_tls_auth_bypass.py","line":224,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-0073/adb_tls_auth_bypass.py:224"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0300/research_poc.py","line":45,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0300/research_poc.py:45"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0300/research_poc.py","line":108,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0300/research_poc.py:108"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0651/exploit.py","line":195,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0651/exploit.py:195"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-0776/CVE-2026-0776.py","line":61,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-0776/CVE-2026-0776.py:61"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-104748/CVE-2026-104748.py","line":161,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-104748/CVE-2026-104748.py:161"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-104748/CVE-2026-104748.py","line":199,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-104748/CVE-2026-104748.py:199"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-104748/CVE-2026-104748.py","line":249,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-104748/CVE-2026-104748.py:249"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-104748/CVE-2026-104748.py","line":333,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-104748/CVE-2026-104748.py:333"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-104945/poc_onvif_ptz_oob_write.py","line":321,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-104945/poc_onvif_ptz_oob_write.py:321"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":366,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:366"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":379,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-105482/cve_2026_105482.py:379"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":395,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:395"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":471,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:471"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":630,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:630"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":634,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-105482/cve_2026_105482.py:634"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":671,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:671"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-105482/cve_2026_105482.py","line":703,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-105482/cve_2026_105482.py:703"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"2026/CVE-2026-110720/exploit.py","line":303,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-110720/exploit.py:303"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-110720/exploit.py","line":358,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-110720/exploit.py:358"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-110912/CVE-2026-110912-ARPBleed.py","line":121,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-110912/CVE-2026-110912-ARPBleed.py:121"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-111967/exploit-cve-2026-111967.py","line":212,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-111967/exploit-cve-2026-111967.py:212"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11499/CVE-2026-11499.py","line":79,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11499/CVE-2026-11499.py:79"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11551/cve_2026_11551.py","line":82,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11551/cve_2026_11551.py:82"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11551/cve_2026_11551.py","line":895,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11551/cve_2026_11551.py:895"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11613/poc.py","line":181,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11613/poc.py:181"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-119712/CVE-2026-119712.py","line":225,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-119712/CVE-2026-119712.py:225"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11991/CVE-2026-11991-exploit.py","line":150,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11991/CVE-2026-11991-exploit.py:150"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-11991/CVE-2026-11991-exploit.py","line":216,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-11991/CVE-2026-11991-exploit.py:216"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"2026/CVE-2026-120490/gcopy_poc.py","line":32,"fingerprint":"python.lang.best-practice.open-never-closed:2026/CVE-2026-120490/gcopy_poc.py:32"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-123158/exploit.py","line":575,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-123158/exploit.py:575"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-123158/exploit.py","line":644,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-123158/exploit.py:644"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-123158/exploit.py","line":743,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-123158/exploit.py:743"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":286,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:286"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":361,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:361"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":502,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:502"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":511,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:511"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":546,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:546"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":557,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:557"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":593,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:593"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12400/exploit.py","line":607,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12400/exploit.py:607"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-12485/CVE-2026-12485.py","line":74,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-12485/CVE-2026-12485.py:74"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-126997/poc_cve_2026_126997.py","line":93,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-126997/poc_cve_2026_126997.py:93"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-126997/poc_cve_2026_126997.py","line":120,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-126997/poc_cve_2026_126997.py:120"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-13001/cve_2026_13001.py","line":34,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-13001/cve_2026_13001.py:34"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-13001/cve_2026_13001.py","line":45,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-13001/cve_2026_13001.py:45"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-1311/CVE-2026-1311.py","line":555,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-1311/CVE-2026-1311.py:555"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'f.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'f.name' is used. Use '.flush()' or close the file before using 'f.name'.","path":"2026/CVE-2026-13714/CVE-2026-13714.py","line":30,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-13714/CVE-2026-13714.py:30"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"2026/CVE-2026-14483/CVE-2026-14483.py","line":179,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:2026/CVE-2026-14483/CVE-2026-14483.py:179"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-15282/cve_2026_15282.py","line":52,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-15282/cve_2026_15282.py:52"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-15282/cve_2026_15282.py","line":60,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-15282/cve_2026_15282.py:60"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-15748/cve-2026-15748.py","line":68,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-15748/cve-2026-15748.py:68"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-15989/antid00t.py","line":217,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-15989/antid00t.py:217"},{"rule_id":"opengrep/python.lang.correctness.no-strings-as-booleans","severity":"high","message":"Using strings as booleans in Python has unexpected results. `\"one\" and \"two\"` will return \"two\". `\"one\" or \"two\"` will return \"one\". In Python, strings are truthy, and strings with a non-zero length evaluate to True.","path":"2026/CVE-2026-15989/antid00t.py","line":949,"fingerprint":"python.lang.correctness.no-strings-as-booleans:2026/CVE-2026-15989/antid00t.py:949"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-16475/exploit.py","line":140,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-16475/exploit.py:140"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-18649/trigger.py","line":34,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-18649/trigger.py:34"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-18649/trigger.py","line":47,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-18649/trigger.py:47"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19286/poc.py","line":197,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19286/poc.py:197"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19295/poc.py","line":91,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19295/poc.py:91"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":476,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:476"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":517,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:517"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":547,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:547"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":588,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:588"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":910,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:910"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-19949/CVE-2026-19949.py","line":1030,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-19949/CVE-2026-19949.py:1030"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21014/can_replay_sim.py","line":17,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21014/can_replay_sim.py:17"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21055/exploit.py","line":122,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21055/exploit.py:122"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21509/CTT-NFS=TEMPORAL-VORTEX v1 CVE-2026-21509.py","line":228,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21509/CTT-NFS=TEMPORAL-VORTEX v1 CVE-2026-21509.py:228"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21627/CVE-2026-21627.py","line":214,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21627/CVE-2026-21627.py:214"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21627/CVE-2026-21627.py","line":650,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21627/CVE-2026-21627.py:650"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21628/CVE-2026-21628.py","line":549,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21628/CVE-2026-21628.py:549"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21628/CVE-2026-21628.py","line":561,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21628/CVE-2026-21628.py:561"},{"rule_id":"opengrep/python.lang.correctness.no-strings-as-booleans","severity":"high","message":"Using strings as booleans in Python has unexpected results. `\"one\" and \"two\"` will return \"two\". `\"one\" or \"two\"` will return \"one\". In Python, strings are truthy, and strings with a non-zero length evaluate to True.","path":"2026/CVE-2026-21628/CVE-2026-21628.py","line":569,"fingerprint":"python.lang.correctness.no-strings-as-booleans:2026/CVE-2026-21628/CVE-2026-21628.py:569"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21628/CVE-2026-21628.py","line":573,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21628/CVE-2026-21628.py:573"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-21902/watchTowr-vs-JunosEvolved-CVE-2026-21902.py","line":103,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-21902/watchTowr-vs-JunosEvolved-CVE-2026-21902.py:103"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-23520/poc.py","line":542,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-23520/poc.py:542"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-23550/CVE-2026-23550.py","line":86,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-23550/CVE-2026-23550.py:86"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-23980/exploit.py","line":72,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-23980/exploit.py:72"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-23980/exploit.py","line":900,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-23980/exploit.py:900"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"2026/CVE-2026-24049/wheelaudit.py","line":1123,"fingerprint":"python.lang.best-practice.open-never-closed:2026/CVE-2026-24049/wheelaudit.py:1123"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-24061/twenty-three-scanner.py","line":979,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-24061/twenty-three-scanner.py:979"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-25643/frigate_rce.py","line":120,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-25643/frigate_rce.py:120"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-25807/CVE-2026-25807.py","line":30,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-25807/CVE-2026-25807.py:30"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-25807/CVE-2026-25807.py","line":43,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-25807/CVE-2026-25807.py:43"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-25994/pjsip-cve-2026-25994.py","line":113,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-25994/pjsip-cve-2026-25994.py:113"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-26119/wac_rce.py","line":117,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-26119/wac_rce.py:117"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-26898/xiaomi_ssrf_exploit.py","line":170,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-26898/xiaomi_ssrf_exploit.py:170"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27097/CVE-2026-27097.py","line":267,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27097/CVE-2026-27097.py:267"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27180/CVE-2026-27180.py","line":214,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27180/CVE-2026-27180.py:214"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27384/CVE-2026-27384.py","line":419,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27384/CVE-2026-27384.py:419"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27384/CVE-2026-27384.py","line":573,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27384/CVE-2026-27384.py:573"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27384/CVE-2026-27384.py","line":606,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27384/CVE-2026-27384.py:606"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27540/x.py","line":91,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27540/x.py:91"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27540/x.py","line":106,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27540/x.py:106"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27574/CVE-2026-27574-OneUptime.py","line":164,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27574/CVE-2026-27574-OneUptime.py:164"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27626/CVE-2026.27626.py","line":123,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27626/CVE-2026.27626.py:123"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27639/account_takeover/poc_account_takeover.py","line":235,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27639/account_takeover/poc_account_takeover.py:235"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27639/privesc/poc_privesc.py","line":158,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27639/privesc/poc_privesc.py:158"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27654/poc.py","line":201,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27654/poc.py:201"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-27886/CVE-2026-27886.py","line":203,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-27886/CVE-2026-27886.py:203"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py","line":94,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:94"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py","line":99,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:99"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py","line":111,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-28372/GNU inetutils telnetd Privilege Escalation.py:111"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-30/exploit.py","line":86,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-30/exploit.py:86"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-30332/exploit.py","line":34,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-30332/exploit.py:34"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-31717/exploit.py","line":504,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-31717/exploit.py:504"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-32604/exploit.py","line":445,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-32604/exploit.py:445"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-32604/exploit.py","line":460,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-32604/exploit.py:460"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-32604/exploit.py","line":483,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-32604/exploit.py:483"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-32604/exploit.py","line":499,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-32604/exploit.py:499"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33032/cve-2026-33032-scanner.py","line":204,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33032/cve-2026-33032-scanner.py:204"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33032/cve-2026-33032-scanner.py","line":499,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33032/cve-2026-33032-scanner.py:499"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33725/exploit.py","line":166,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33725/exploit.py:166"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33725/exploit.py","line":191,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33725/exploit.py:191"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33868/CVE-2026-33868.py","line":75,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33868/CVE-2026-33868.py:75"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-33868/CVE-2026-33868.py","line":82,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-33868/CVE-2026-33868.py:82"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-34159/linux_exploit_llama.py","line":325,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-34159/linux_exploit_llama.py:325"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-34197/exploit_poc.py","line":220,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-34197/exploit_poc.py:220"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-34197/exploit_poc.py","line":259,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-34197/exploit_poc.py:259"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-34197/exploit_poc.py","line":276,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-34197/exploit_poc.py:276"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3456/race_condition_exploit.py","line":48,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3456/race_condition_exploit.py:48"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3456/race_condition_exploit.py","line":59,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3456/race_condition_exploit.py:59"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3456/vulnerable_auth_server.py","line":48,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3456/vulnerable_auth_server.py:48"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-34990/exploit.py","line":261,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-34990/exploit.py:261"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-35333/poc.py","line":161,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-35333/poc.py:161"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-35333/poc.py","line":168,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-35333/poc.py:168"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3584/mass_scanner.py","line":201,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3584/mass_scanner.py:201"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3584/mass_scanner.py","line":335,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3584/mass_scanner.py:335"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-36848/exploit.py","line":85,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-36848/exploit.py:85"},{"rule_id":"opengrep/python.lang.correctness.exceptions.raise-not-base-exception","severity":"high","message":"In Python3, a runtime `TypeError` will be thrown if you attempt to raise an object or class which does not inherit from `BaseException`","path":"2026/CVE-2026-36848/exploit.py","line":121,"fingerprint":"python.lang.correctness.exceptions.raise-not-base-exception:2026/CVE-2026-36848/exploit.py:121"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-38427/CVE-2026-38427_poc.py","line":126,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-38427/CVE-2026-38427_poc.py:126"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-38427/CVE-2026-38427_poc.py","line":143,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-38427/CVE-2026-38427_poc.py:143"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-38427/CVE-2026-38427_poc.py","line":146,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-38427/CVE-2026-38427_poc.py:146"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-38751/poc.py","line":131,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-38751/poc.py:131"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3888/cve_2026_3888_poc.py","line":180,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3888/cve_2026_3888_poc.py:180"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-3891/CVE-2026-3891.py","line":417,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-3891/CVE-2026-3891.py:417"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"2026/CVE-2026-39127/boboverflow.py","line":139,"fingerprint":"python.lang.best-practice.arbitrary-sleep:2026/CVE-2026-39127/boboverflow.py:139"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0277,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.2547,"test_lines":4673.0,"source_lines":336927.0,"test_ratio":0.0139,"ci_files":1.0,"cochange_share":0.0637,"cochange_commits":267.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/actions.yml","ref":".github/workflows/actions.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":35.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0058,"check:low_escape_density":1.0,"escapes":180.0,"escapes_per_kloc":0.655},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: 2026/CVE-2026-30849/tsconfig.json","ref":"2026/CVE-2026-30849/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":["phantom-dependency"]}