marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
30921a12b9acfffcfc748e1964e7f3d23830a2be
Open_Ultra_SAST/benchmarks/valid/train/verification.json
T

5165 lines
178 KiB
JSON
Raw Normal View History

data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
{
"cases": [
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "acacode-swagger-typescript-api-c4257c99ff0cfe5f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "swagger-typescript-api CLI/generateApi() consuming an attacker-controlled OpenAPI spec path (e.g. `sta generate --url https://attacker.example/openapi.json`); the injected `${...}` in the spec path is interpolated into the generated method's `path: \\`...\\`` template literal and evaluated when the generated method is called.",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "acacode-swagger-typescript-api-e64e7a7e89c832b6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "lazybeforeunveil event handler reading data-vimeo/data-vimeoparams attributes from DOM elements",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "afarkas-lazysizes-7b62735d3e5d1714",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "lazybeforeunveil event handler / click handler on element with data-youtube attribute",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "afarkas-lazysizes-99fc6cf6e6f1f846",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "next-intl middleware with localePrefix: 'as-needed' (external application middleware, not a concrete in-repo route/handler)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "amannn-next-intl-10fdf55408ba9a03",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "startWebServer -> app.listen(PORT) binding all interfaces; HTTP routes GET /api/documents, POST /api/documents, DELETE /api/documents/:id, POST /api/search-all, GET /api/config",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "andrea9293-mcp-documentation-server-0913a4303cf82c9a",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "parse() in source/modules/database/custom/index.js, invoked from database config UI; data source is shell-findOne IPC result (info['database'])",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-0abdb762876f58b3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "modules/database/php/index.js parse() rendering database config tree text",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-4b97e82397da81ee",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "checkprobe() invoked from database module UI; data source is remote server response via that.drive.core.request(that.drive.core.base.probedb())",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-98183d78558cfa95",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "parse() in modules/database/asp/index.js reading database config via ipcRenderer shell-findOne",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-b0cec123d7799276",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "SearchLayoutView.renderTypeTagList / getFilterBox (Backbone Marionette view rendering search type/tag dropdowns)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-0ba0aadbe86a1987",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-10c9d446ebf3bb21",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SearchResultLayoutView.getFixedDslColumn / getDaynamicColumns formatters rendering entity attributes via Backgrid Html cells; source is search API response entity attributes (e.g. name, typeName, custom attributes) rendered into DOM",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-3f751971e2a63d2e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Header view onRender: that.$('.userName').html(Globals.userLogedIn.response.userName) renders the authenticated user's userName via .html() (DOM XSS sink); source is the logged-in user's userName from the login response, reachable when the Header view renders after authentication.",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-42a370a3cdec7d12",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "React route /search/searchResult (FilterQuery component); source: URL query string via location.search / URLSearchParams, attacker-controlled filter params (type, tag, relationshipName, entityFilters, tagFilters, relationshipFilters) rendered into Chip labels",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-4c582bc549c555a1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-5373cc60e39f63cb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "sanitizeHtmlContent (dashboard/src/utils/Utils.ts)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-7f7bd8d16a1151b1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Backbone Marionette view RelationSearchResultLayoutView rendering relationship search results; data from relationship search API (getBasicRearchResult/fetch) flows into Backgrid Html cell formatters (e.g. col['label'], col['typeName'], col['name']) that build HTML strings without escaping, enabling stored XSS for an authenticated user.",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-940ab56a7aadcda1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ShowMoreText React component (dashboard/src/components/ShowMore/ShowMoreText.tsx)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-9ddeccc45a8bbeb5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "HtmlRenderer React component (htmlString prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-ea6cfd8c8ed3e117",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CommonViewFunction.propertyTable / fetchInputOutputValue (dashboardv2/public/js/utils/CommonViewFunction.js)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-eec08160065d0b9b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-f8d76d90d767826b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaSplit (invoked via SpecificCompiler.compileSchema / velocity template generation from untrusted Avro schema)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-1c1ac5d9361c069c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaEscape via javaSplit during specific record generation from untrusted Avro schemas",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-1d43772609028459",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaAnnotations(JsonProperties) invoked during SpecificCompiler code generation from Avro schema JSON (javaAnnotation property)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-f133a25fc910fb31",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "execute_sql_query(sql, connection_manager, **kwargs) MCP tool convenience function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-doris-mcp-server-58f237c099a19c43",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-0209dc8ff7a5a0b9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-203931cda95af8bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-29fe382661669370",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-35b46d5635d33c30",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-46458e154673da1a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-5b201fbf15fe43ca",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-68401dcb84d645a6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-6ff76988cae7dfa5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-8083f17f7cbadd46",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-9a97c39706187df2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-9c4ae45efeed53a7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a05c81da5a0b21df",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a176addda844a7ce",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "getLessSpecificLocale(Locale) called during localized template lookup with attacker-controlled locale identifier",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-a74ec0787d3280ea",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a765c68d84f2b828",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-aace5c9941b635b3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-c0f61114ff3ab48a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-cf639b1623d15342",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-cfc58a253de5f6bd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d058151619a90d08",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d260924010aace8a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "TemplateCache.lookupWithLocalizedThenAcquisitionStrategy (invoked via Configuration.getTemplate with attacker-controlled Locale)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d3c7bc0ea1b565c4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-d4b9c3b8b1a5b2c3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-eb721acc4b96dd7f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-eb9b0fff47e5400b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f10a2c2cfda93e16",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f5ba78c9c91de7a1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f78f7186c5610790",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-fabd1840fb3c1eed",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "JMXConnector.doStart() invoked via GBean lifecycle during server startup; JMX connector accepts remote RMI connections",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-geronimo-0779e8a19c60e8ad",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "JMXSecureConnector.doStart (JMX connector server startup)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-geronimo-469d656c92e703bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "JMSSource.doProcess (JMS Source configured via Flume agent config providerUrl)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-logging-flume-2f03541bca7f3237",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JMSSource.doConfigure via providerUrl configuration parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-logging-flume-3a9f6e6ef1ab1349",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JMSMessageConsumer constructor via JMSSource providerUrl configuration (initialContext.lookup(destinationName))",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-logging-flume-9dd9e4ee8d0de85f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-pdfbox-11311474dc9fddbd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() flows into extractFile(filePath, filename, embeddedFile)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-3dc4e739d0307166",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "main(String[] args) CLI: args[0] PDF file path; embedded file names from PDComplexFileSpecification.getFilename() flow into extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-56ad35de6b5478ab",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() in PDF content reaches extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-7d8d6513c163f5fe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() concatenated into extraction path",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-pdfbox-d700dd5c8843f12c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() appended to extraction path in extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-f03695e9a3bbfb76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-2290116e5febf3c6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "queryBasicTraces (ITraceQueryDAO) invoked via GraphQL trace query; endpointName parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-5eb8d566abf7ce37",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "searchEndpoint(keyword, serviceId, limit) - keyword concatenated into SQL LIKE clause; no in-repo HTTP route or CLI argument shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-80e3e3e53c0f37a0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter) invoked via alarm query GraphQL/REST handler; no concrete in-repo route or attacker-controlled source shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-9ea0241fb2a1d2cc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "searchServices(keyword) via metadata query API",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-a7df135a93d33dbc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "arc\\url\\Url::__construct($url)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "ariadne-cms-arc-web-dedc841aa3fcd892",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "WxCryptUtil.extractEncryptPart(String xml) via BUILDER_LOCAL DocumentBuilder",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "binarywang-wxjava-81c6bfb8c7d2780a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "BaseWxPayResult.getXmlDoc() parsing attacker-supplied xmlString (e.g., via toMap/getXmlValue), but no concrete in-repo HTTP handler or CLI route is shown in the provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "binarywang-wxjava-bb0f4f6e3747df3f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Vue component render (b-table caption prop) - no in-repo route/handler/CLI source established",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-07356b6e97b97bc0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "b-pagination component prop ellipsisText / firstText rendered via domProps innerHTML in makeEllipsis",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-28832e100e7f287c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Vue component render function (b-table) using this.caption prop bound to innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-28e8c5390cd69d63",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-nav-item-dropdown component render (text prop via innerHTML)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-4956693c54c51e2d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "makeEndBtns render function in src/mixins/pagination.js (btnText via props/slots)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-5c23596323e6b8a9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "pageLinkClasses (page) method in src/mixins/pagination.js",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-62335f9ab1503cb8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "formOptions computed property in src/mixins/form-options.js (options prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-63c25165cde74e91",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "b-dropdown component render function (this.text prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-89a979a090308f7b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "render() in src/components/progress/progress-bar.js via the `label` prop rendered with domProps.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-961a13bdb159074a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "card-body component render function via title/subTitle props",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-9cb0f01421a910d4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-form-group render function (label prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-a3dc3bb9b99618da",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-dropdown component render (this.text prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-ad0ba8cae6e3210c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "jumbotron component render function (props.header / props.lead)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-afa3ef454d76061d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "bootstrap-vue InputGroup component render function (props.prepend / props.append)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-b376dace0b85c60c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "render (h) in src/components/modal/modal.js; title prop rendered via h(this.titleTag, ...) without sanitization",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-b7c3ceceb8ee2f53",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-table component render() -> makeHeadCells() using field.label via domProps.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-f1906edae2e32153",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "codecov/__init__.py:main() CLI entry point; attacker-controlled source: --gcov-args / --gcov-exec / --gcov-root CLI arguments (argparse) flowing into cmd string passed to try_to_run (popen)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "codecov-codecov-python-261567376b9ecd8e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "WebPageLoader.load(source_content) via crewai_tools.rag loaders; source is SourceContent.source URL supplied by the caller",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-0c90e759dac62125",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "DOCXLoader.load -> _download_from_url (source_content.source_ref URL)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-3736ee46eb9984b5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "DocsSiteLoader.load(source) via source.source URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-4591ac4ce34038bb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "PDFLoader.load(source) -> _download_from_url(url, kwargs)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-4a0af130f248da07",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "MCP tool git_clone (gitCloneLogic) invoked via MCP tools/call with attacker-controlled input.targetPath/repositoryUrl/branch reaching child_process.exec",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyanheads-git-mcp-server-07d42f8af21c4e1d",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "MCP tool git_init (gitInitLogic) invoked via tools/call with input.initialBranch",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyanheads-git-mcp-server-3c306de22fb76061",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "EmailTermsView at url /terms/email; GET parameter returnTo flows via get_initial into form initial, then form_valid sets self.success_url from form.cleaned_data['returnTo'] without validation, causing open redirect",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-1b3a86185cb651c3",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "AcceptTermsView.post at URL /terms/accept, reading request.POST['returnTo']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-387ba4069e5df737",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /terms/accept/ with returnTo parameter handled by termsandconditions/views.py returnTo function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-8ee6351ba4d07811",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /terms/accept/ with returnTo parameter (termsandconditions/views.py returnTo function)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-95885d31451074da",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "AcceptTermsView at url /terms/accept; GET parameter returnTo read via self.request.GET.get(\"returnTo\", \"/\") in get_initial",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-d51b737f5af17360",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CLI --input-file-type protobuf with --input/--url; _ProtoInputPreparer.__enter__ -> _write_missing_weak_imports",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "datamodel-code-generator-datamodel-code-generator-5533ebd26fe5db29",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "CLI: datamodel-code-generator --input-file-type protobuf --input <attacker-controlled .proto> (or --url); source: WEAK_IMPORT_PATTERN capture group from the proto text reaching _write_missing_weak_imports",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "datamodel-code-generator-datamodel-code-generator-bd146f812470891a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "get_frontend_context_variables",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "django-commons-django-unicorn-12a63e34be303045",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "CLI command `convert` (docling/cli/main.py) with `--html-image-headers` and `--html-image-fetch remote|all`; attacker-controlled source is the untrusted HTML document's `<img src>` URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-442cf60d08eedb5a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTMLBackend._render_with_browser via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the untrusted HTML document's <img src> URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-6fdb354a87a33a5b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ImageResourceLoader.__init__ (headers parameter); CLI --html-image-headers with --html-image-fetch remote/all",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-79c0c9a6f809c850",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "docling-project-docling-a3a58e4798820a2f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTMLBackend._route_request via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the document's <img src> URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-e161c7347b530396",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dromara-sureness-229b3e58be2cea98",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dromara-sureness-fe133861b4331e26",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "dtwang-line-desktop-mcp-0211ddfcea45a218",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "CLI --http-mode --port 3000 binds Express app to 0.0.0.0 and exposes POST /mcp Streamable HTTP endpoint without authentication",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "dtwang-line-desktop-mcp-11072dcfdfa41a45",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "Express app.all('/mcp') handler in LineDesktopMCPServer.run() invoked via CLI --http-mode --port; attacker-controlled source is the unauthenticated HTTP POST to /mcp (req.body initialize / mcp-session-id header) reaching transport.handleRequest and MCP tools",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "dtwang-line-desktop-mcp-b9429141072345c4",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "initTemplateList (CLI options.template)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "easy-team-easywebpack-cli-b9675c77904bca7d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "filegator-filegator-3e6375432d7d1672",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "filegator-filegator-a4e0e2b35d13f929",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "scopeSearch invoked via Eloquent search scope; no concrete in-repo route/handler or attacker-controlled source provided in the supplied file context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fiveai-cachet-29e687ca594eba8e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.35,
"entry_point": "execute_module monitor.http_check {url:...}",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-2a4e38c04fd5f6be",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-34e3395590f26492",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-53361f3afc1d0761",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-720084a3ead8521c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.35,
"entry_point": "execute_module graphql.query {url:...} -> _prepare_graphql_request",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-730f3f6c3f5e3112",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "execute_module slack.send {webhook_url: attacker-controlled}",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-922d1d2f64c30590",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "execute_module http.request {url: attacker-controlled} -> http_request() -> session.request(method, url, allow_redirects=True) follows 302 into internal space",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "flytohub-flyto-core-9648472ee6b1bd21",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "execute_module http.get with attacker-controlled url parameter (http_get in src/core/modules/atomic/http/get.py)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "flytohub-flyto-core-c57a8e72e5f62c6f",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-cf56d8dfb0fcb584",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-d56b51ea8b6eec43",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-f8f7252f12890138",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fusesource-hawtjni-18415170793563b7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Library.exractAndLoad (called from Library.load via classLoader.getResource)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fusesource-hawtjni-f763d2029e719e50",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "display_evaluation_run_status(eval_run_obj) called in Jupyter/Colab; error_message from eval_run_obj.error",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-0ac10c09d9bb7ce5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_inference_html(dataframe_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-ae123ecdc45075bf",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_evaluation_html(eval_result_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-c97b4cfd80013853",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_comparison_html(eval_result_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-d6824d56240b0069",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Playground component constructor (props.schema) in packages/graphql-playground-react/src/components/Playground.tsx",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-779f126239ce96a4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; introspection type names reach renderType via onHasCompletion autocomplete, then injected through information.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-8a960cf0662c724e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "SchemaFetcher.fetchSchema via endpoint query parameter (session.endpoint) loading a malicious schema",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-8ab7cfafbc027403",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "GraphQL Playground React app loaded via graphql-playground-html/middleware; endpoint query parameter (?endpoint=...) sets the schema endpoint, and the fetched introspection schema flows through props.schema into UNSAFE_componentWillReceiveProps in Playground.tsx",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-94e027d23fc54155",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; onHasCompletion renders untrusted schema type names via innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-afc7c3fd32fb660f",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Guzzle Client cookie handling via CookieJar::matchesDomain (e.g. new Client(['cookies' => true]))",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "guzzle-guzzle-71918799e733c0fa",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "is_url_safe (exported helper) called by external consumers; no in-repo route/handler/CLI source shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hackingrepo-dssrf-js-ecfa495c64d13a59",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hjson-hjson-java-0100a1cb12b60b6a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-117903a04ddebe6e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> ExtractShadowStrategyTool (journal_path) -> safe_user_path",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-16a24d8276343ff1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-1b7a462b5edd6f25",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-36bca05009805ae2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-3eeced0e67bd3443",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-3fe5123aa283389c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-4055b927694ed3d9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-489a94725fbd4ac9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-490c1fadec0168f7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-4bc98a6c0e318002",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-53b8e8b13c96984b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-54e08745442bc15e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "POST /sessions/{session_id}/messages -> SessionService.send_message -> _run_attempt -> LLM tool registry (read_document / safe_user_path-gated tools)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-7f6e6e7392e1389e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-840eb07dfbe96e75",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> DocReaderTool.execute -> read_document(file_path) with attacker-controlled file_path from chat message",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-866d7a8070276364",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-925032218d1d77e4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-9b681020685fe0e7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-a10dddba8add7fac",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "POST /sessions/{session_id}/messages -> send_message -> svc.send_message -> agent loop invoking read_document / safe_user_path-gated tools",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ad7c628e2179fe31",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "BacktestTool.execute -> run_backtest(run_dir) via POST /sessions/{sid}/messages LLM tool invocation; run_dir is attacker-controlled via prompt injection",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c16e9e336b3428d7",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> PatternTool.execute -> run_pattern(run_dir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c504e5fd82839ef8",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c6867edb99dcb1d1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c92f45b95e1d0b54",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-cd0aa698868347a5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-d15ad3bf7a566ce3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "build_registry (agent/src/tools/__init__.py) - tool auto-discovery; advisory claims reachability via POST /sessions/{sid}/messages on port 8899, but no such route/handler is present in the supplied file context",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-dc628e0182f9c1ae",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ebb08ee489b9450b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-f4657c425bc7405e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "POST /sessions/{sid}/messages -> SessionService._run_with_agent -> AgentLoop.run -> build_registry tools (read_document / safe_user_path)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-fc64bd08539555f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-fefd053d0fc19401",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ff88c73cf17f2c68",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-4ddc46798ca8e7d6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Lovelace Statistics Graph card (statistics-chart.ts) rendering ECharts tooltip via formatTooltip; source is entity name from getStatisticLabel/computeStateName (attacker-controlled via helper or integration-provided entity name)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-588ec87d01bd562c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ZWave JS network visualization panel (zwave_js-network-visualization custom element) tooltip formatter rendering device names via ECharts tooltip",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-589375de71f6b2f2",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-61bf65e9dd9a81f3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Statistics Graph card / state-history-chart-timeline.ts _renderTooltip (seriesName from entity name via getStatisticLabel/computeStateName)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-72bcad0f4ba8aa00",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-ade4d24b167a84dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Statistics Graph card (statistics-chart.ts) rendering entity name via getStatisticLabel -> computeStateName into ECharts tooltip; attacker-controlled source is the entity name set via helper/integration",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-d7404ee83aa6f810",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "Statistics Graph card tooltip rendering (statistics-chart.ts _renderTooltip) via entity name from getStatisticLabel/computeStateName; the provided file is ha-sunburst-chart.ts, not the statistics chart",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-dbfdac609f80500c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Lovelace Statistics Graph card tooltip formatter (_renderTooltip) rendering entity name from getStatisticLabel/computeStateName; attacker-controlled source is the entity/statistic name set via helper or integration",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-f515548346e64ad5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "XSLTProcessor.transform (JS-exposed @JsxFunction transformToDocument/transformToFragment) invoked from attacker-controlled webpage JavaScript in HtmlUnit browser",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "htmlunit-htmlunit-2d8f01031e36f7f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "is_private_url called via validate_request_url for user-provided URLs (e.g. event organizer-supplied URL fields); no concrete in-repo route/handler with attacker-controlled source is established by the provided file context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "indico-indico-7df3dccdecfcf290",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "RemoteImageMixin.validate_remote_image via DRF serializer field 'remote_image' (URLField) on API endpoints using RemoteImageMixin; attacker-controlled source is the remote_image URL submitted in the request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "inventree-inventree-3c189cf58ad5161c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "powerline segment GitStatusSegment invoked when shell prompt renders in a directory containing a malicious .git/config (core.fsmonitor)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jaspernbrouwer-powerline-gitstatus-02af01b55c83b1b6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "clean_data (jquery.terminal.js) invoked during terminal formatting of user input; no in-repo route/handler/CLI argument shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-14e90f7dbacbca75",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "clean_data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-5fac75c0184dbcd6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "clean_data (jquery.terminal formatter/attribute rendering)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-cb10a82f25867022",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-3b5afa072c43cab3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "AnsiblePlaybookStep.AnsiblePlaybookExecution.run() invoked via the ansiblePlaybook pipeline step; extraVars parameter (step.extraVars) is attacker/user-controlled and passed to convertExtraVars",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-4904f1516a63debe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "extraVar (Job DSL context method)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-992e550732edf17b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "appendExtraVars (invoked during Ansible build step execution; extra vars configured via job configuration form)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-bfcea0679f20d5f1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-1561c6b78bc53ad9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CodeBuilder.perform (Jenkins build step) via readResolve deserialization of persisted CodeBuilder config",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-3c24887c571b4cb0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "CodeBuildStep.CodeBuildExecution.run (Jenkins build step)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-3d0bfc1f65a1d762",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CodeBuilder @DataBoundConstructor (Jenkins job configuration form)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-6ad10434eea5ee64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "CodeBuilder.perform (Jenkins Builder) - AWSClientFactory constructor with getParameterized(this.awsSecretKey)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-74b2064ce4792a4c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "AWSClientFactory constructor (credentialsType=Keys path) invoked from build configuration; no concrete in-repo route/handler shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-78b40b445eb31871",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doFillCredentialsIdItems (Jenkins Stapler HTTP endpoint helper)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-credentials-plugin-79ab9c6465c74964",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-configuration-as-code-plugin-26c452bafd056c70",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SecretBuildWrapper.decorateLogger / LineTransformationOutputStream.close (Jenkins build log output stream)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-credentials-binding-plugin-912adeb590b59d23",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-credentials-binding-plugin-d713906e76e2660a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doCheckDependencyTrackFrontendUrl (and doTestConnection) invoked via form validation request; attacker-controlled source is the @QueryParameter value / dependencyTrackApiKey and credentials ID",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-dependency-track-plugin-673cc48b4f75ebf5",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins HTTP endpoint doCheckDependencyTrackUrl (and doTestConnection) reachable via Stapler form validation; attacker-controlled source: @QueryParameter value / dependencyTrackUrl and dependencyTrackApiKey",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-dependency-track-plugin-90b566be2c3aebff",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doTestConnection (descriptor form validation endpoint, e.g. /descriptorByName/.../testConnection) with attacker-controlled dependencyTrackUrl and dependencyTrackApiKey query parameters",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-dependency-track-plugin-9e8488d96f7c0424",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "configure(StaplerRequest, JSONObject) global configuration handler",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-2cdae87438f0fc39",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "GitlabLogoProperty.getProject() via getIconUrl()/getRepositoryUrl()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-46246cf241510f0a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins global configuration form submission handled by DescriptorImpl.configure(StaplerRequest, JSONObject) via Stapler; attacker-controlled source is the privateToken form field in the submitted JSON form data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-f771ba20ac33c126",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "readResolve() on PluginDescriptor during Jenkins XML deserialization of hudson.plugins.jira.JiraProjectProperty.xml",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-jira-ext-plugin-28565b34d1c8489d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JiraClientFactoryImpl.newJiraClient()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-jira-ext-plugin-9bc3b4180b83656a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doFillJenkinsSitesItems on JobImportActionDescriptor (fill field for Jenkins sites), reachable by any authenticated user with Overall/Read permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-job-import-plugin-07e0e7023a46cf4d",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint /jobImport/fillCredentialIdItems (doFillCredentialIdItems on JobImportActionDescriptor), reachable by any authenticated user with Overall/Read permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-job-import-plugin-5509a356384e862e",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "MarkupFormatter.translate(String markup, Writer output) invoked by Jenkins when rendering descriptions configured with the Markdown Formatter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-markdown-formatter-plugin-9c93ac91e86f4cc5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "MarkupFormatter.translate invoked by Jenkins rendering of user-editable descriptions",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-markdown-formatter-plugin-dd25c90bea9a886e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doCommenceLogin(@QueryParameter String from, @Header(\"Referer\") String referer) -> getValidRedirectUrl(from != null ? from : referer)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-oic-auth-plugin-072cfcf18988ef12",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doOwnersSubmit(StaplerRequest req, StaplerResponse rsp) via HTTP form submission to the job ownership config page; source: req.getSubmittedForm() JSON 'owners' field",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-ownership-plugin-aec8f0570f4b80f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "Stapler HTTP endpoint doChangeSubmit (P4Hook) reachable via Jenkins Stapler routing; attacker-controlled source: StaplerRequest parameters (_.p4port) and submitted form",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-p4-plugin-5022afedadfe8449",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "P4Hook.doChange (HTTP endpoint /p4/change via StaplerRequest)",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-p4-plugin-65a59903d43924ee",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP endpoint doBuild/doBuildSubmit on ReviewAction (urlName 'review') via StaplerRequest parameters",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-p4-plugin-85c3775c29eb0c5c",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP endpoint /review/buildSubmit (Stapler doBuildSubmit) reachable via Overall/Read authenticated user submitting form data",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-p4-plugin-a1c0ab5c3582fc3b",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "UnprotectedRootAction P4Hook at URL /p4, HTTP endpoint doEvent (and doChange) reachable without authentication; attacker-controlled source is the HTTP request body/JSON payload (req.getInputStream)",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "jenkinsci-p4-plugin-fdef12ac487474fb",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-113227759c983f0a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-1361f56765dbad32",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "setApiToken via @DataBoundSetter during Jenkins global configuration save (RemoteBuildConfiguration.xml)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-5b7b011daea8e88e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "setAuthorizationHeader(URLConnection, BuildContext) invoked during remote build trigger HTTP request; apiToken sourced from Jenkins global configuration (RemoteBuildConfiguration.xml)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-f066bf7b2ae56763",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Pipeline Maven Integration plugin Maven build step parsing maven-spy.xml from agent temporary directory (listGeneratedArtifacts)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-pipeline-maven-plugin-f7e9c244b67b36a6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "InfoParser.parseFor parsing reportFile (Selenium HTML report file) via getReportFileFor(build, testResult, seleniumReportsDir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-seleniumhtmlreport-plugin-596bcea5f710622a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "getPom(FilePath workspace) -> MasterToSlaveFileCallable.invoke parses pom.xml (BUILD_FILE) via DocumentBuilderFactory without disabling external entities",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-semantic-versioning-plugin-7a6f61fea77b9da3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "doDownloadAttachment Stapler request handler (Jenkins Stapler route /downloadAttachment) reading request parameter \"f\"",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-tap-plugin-b1954cc1fc64febe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-22b29c9f11c9c050",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "archiveZap() Jenkins Pipeline step (ArchiveZapExecution.start)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-35e96c45d9357469",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "archiveRawReport called from ZAP Pipeline build step (ZapBuilder/ZapStep) during Jenkins build",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-5ee6ae7d06c3ad5e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "ZapAction.doDynamic (Stapler route /job/<job>/<run>/zap/... via getUrlName() returning ZapArchive.DIRECTORY_NAME), serving DirectoryBrowserSupport content; attacker-controlled source is files in the workspace/archived artifacts",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-953ab12f1f2d06d9",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-f405bf70465980bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-561dd51556f2b530",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "GET /api/<entity>?sort=... (generated reactive entity list endpoint; sort parameter)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-98eceaae5495db76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-b5bedd365fd447dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-d40433c5e5a179bb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.97,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-e25ba8d07362b033",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "GET /api/<entity>?sort=... (generated reactive entity list endpoint; sort parameter flows into EntityManager.createOrderByFields)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-e4ad88d8f028b8fe",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-ed98b23f033108c6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-6358e99ead4eb079",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-caf11625421e51b5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "TagSet.valueOf(String tagName, String namespace, ParseSettings settings) called during HTML parsing of untrusted input via Jsoup.parse / Cleaner with a custom Safelist",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-fb24c11d6f1b2ae3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-0409fd38692653dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-17356dc985f12ca8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-2ae7bec575002cc8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); caller-controlled source: Sales Invoice Item.asset Link field in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-39e17ab80d48e54e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-46e518f703a36dc0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-48f1f22be6ba9f48",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "pacioli CLI build_parser (broker/pacioli/cli.py)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-9f19515916d1f37b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale (item row 'asset' Link from request body) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-b26b532c43a68565",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-b3ff7c846381ada8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "pacioli doctor CLI subcommand (cmd_doctor)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-f63aa31ecca38c1c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "api.tools.parse_response / api.helper.get.visible_emails_post / api.helper.get.email_data_post",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "kartiktalwar-gmail.js-301ae79245460d39",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "MongoDBSaver.deleteThread(threadId)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "langchain-ai-langgraphjs-920b675720dbc952",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "parse_env_variables via Trainer initialization reading PL_TRAINER_GPUS environment variable",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "lightning-ai-pytorch-lightning-8a9ebfbdcc58e73e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.appendOneByte) reached via FileService under a path prefix, e.g. GET /files/..%2Fsecrets.txt",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-143c39cfd2874e4c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ArmeriaHttpUtil.decodePath invoked from HTTP request path handling (e.g., FileService under /files)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-1a9b7d60cd9e8330",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTTP request path handling in Armeria server (PathAndQuery.splitPathAndQuery invoked from request path parsing); attacker-controlled source is the request path containing %2F, e.g. /files/..%2Fsecrets.txt",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-3196308da59204ff",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ArmeriaHttpUtil.decodePath (called from Armeria server request path handling)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-36dfac02c436f929",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "HTTP request path handling in Armeria server (e.g., FileService under /files)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-5e40f3c4fd9a04ba",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "line-armeria-7fb77b8814401e5d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "RoutingResultBuilder.rawParam called during HTTP request routing; no concrete in-repo route/handler or attacker-controlled source shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-ecc4313228868198",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.parse) invoked via FileService under a route such as /files, attacker-controlled source: request path containing %2F",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-fff692dc76424e72",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-4d161f6aa8f9499a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-70cbfb17db2cecb4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "lhc_web/cli/lib/install.php step3() invoked via CLI installer (php cron.php / install script)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-90e4ec70ac068666",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-db8669fb4edb63c2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "ljharb-shell-quote-74ceec6e8c431f73",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "iziModal('open') plugin method invoked by page JavaScript with attacker-influenced options.title",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "marcelodolza-izimodal-afd617de248065eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "commandExists(commandName, callback) exported function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "mathisonian-command-exists-5c2ea6b59177e0dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-0fa875b67930ece7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ImageViewTransform.__init__ (model_dir from config file dey_mini.yaml ['nnet']['module'])",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-1d41167fffcc5136",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "DROEstimation.__init__ via model loading (model_dir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-36d2bd78fdd5731d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-3718dff6ca9e3eb5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "LinearAECPipeline.__init__ (pipeline instantiation via modelscope pipeline API)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-71fef32c90c184a3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "Model.__init__ via configuration file key ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-75fd1dee4ec928eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "PedestrainAttributeRecognitionPipeline.__init__ via pipeline(Tasks.pedestrian_attribute_recognition, model=...) with attacker-controlled model config",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-bb25a58bfaca076c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Template._save_pil_image (static method in swift/template/base.py); no in-repo route, request handler, or CLI argument is shown reaching it with attacker-controlled image data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-ms-swift-600a21056f8085a7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "import_report_from_email(content) -> import_archive -> import_report; content originates from DMARC report emails sent to the rua address of a domain",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modoboa-modoboa-dmarc-7b9ba42b6d644e40",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "import_report(content) called with XML content from emailed DMARC reports (rua address)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modoboa-modoboa-dmarc-9e011e2d13bc2f47",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "saveAttachments (LocalFileSystemAttachmentServiceImpl) invoked via Genie API multipart/form-data attachment upload",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "netflix-genie-3c700ed384082b01",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "HerokuAddonPool(id, app, opt) exported function; app parameter interpolated into cp.exec",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "nodef-heroku-addonpool-e3d374b9c51542a9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "unadded()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-06a6c2a9fdaf1fe6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "module.exports = async function(tag) in lib/tag/index.js",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-0cd4fa8d294bb15c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "module.exports function in lib/modified/index.js (library API, no in-repo route/handler/CLI)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-1c70190766100c0e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "lib/remote/index.js remote() (test file lib/remote/spec.js)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-c2e0fe13af8ae7dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "remote()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-e3f54204efc8569d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-08eea42408cf3b85",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Project.__init__ via CLI generation from an OpenAPI document (openapi.title used to build project_dir path)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-6597f2ff2bd4d4af",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (snake_case called on schema names)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-eec25cd455fc2186",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (tag names flow into _build_api file paths)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-faf2d6df0e1fba6a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openstack-nova-4045dc3bd0ca9f47",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Bash.run (metagpt/tools/libs/terminal.py) invoked as an LLM tool; no in-repo HTTP route or CLI argument source is shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "paipeline-metagpt-5bf0b5683141e177",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-8a7c60e38d5f4edd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-9e79068fd7901a91",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "Terminal.run_command (no in-repo HTTP route or CLI argument shown reaching it)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-bf0e585f3114f491",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-c3a25a317f77d4e7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__ -> etree.parse(xmlf)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-d8f99d8829b06c72",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "petl.io.xml.fromxml",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-fe2841388aef1fd9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "HTTP GET / handler _on_root_request_cb reading request.url.query (_state_id_)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-3537c0dd41a40d38",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request query string `_state_id_` parameter reaching `_load_state_qs` (bookmark restore path)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-78e995f1fddd0cb5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request query string parsed by RestoreContext.from_query_string via the Shiny bookmark-restore path; attacker-controlled source is the `_state_id_` query-string parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-8fd07b2eca54563e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "posit-dev-py-shiny-c4952ae2ef71c906",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "posit-dev-py-shiny-d9a1d7c28404388d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "getErrorDiv called from fetchAndGenerateResults error handler; source is search API response error message",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-391e2f80eb80c3c8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "generateSingleResult (called from generateSuggestionsList with search backend response data)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-885af7a7682d69e3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "get_section_html",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-eb34d0b4ee01b206",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "plot(options)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "rkesters-gnuplot-d931b1756db47945",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "language_attributes filter via cleanHtmlMarkup()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "roots-soil-8fa3ef8a493b8d64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Inventory.php store() method, invoked via Livewire request from the admin product inventory form; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-02254beed509364c",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Customers\\Orders (public $customer property, table()/render()); attacker-controlled source: Livewire client-side property tampering of the unlocked public ShopperUser $customer",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-047e62abed0b91fa",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Livewire\\Components\\Orders\\OrderNotes::leaveNotes(), invoked via Livewire update request from the order detail admin panel; attacker-controlled source is the public $notes property and the Livewire-callable leaveNotes action",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-052f88a347caf2eb",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire admin component Settings/Team/Index (table recordActions DeleteAction) reachable by any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-064f0b5f8937aae5",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-0d7758a9a7d45a31",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin Order Detail component action markCompleteAction (Filament action callable by authenticated low-privilege panel user with read_orders)",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-0fd6e8d87dd0ed82",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Team/RolePermission::save() invoked via Livewire update request from the admin panel route (shopper settings team role page); attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-1112cc61420816ff",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-137aa7e49095c9df",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Products\\Form\\Edit::store() invoked via Livewire update request from the admin product edit form; attacker-controlled source is the Livewire form state (data) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-13fdb238d0d8e573",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Detail.php::capturePaymentAction (Filament action 'capturePayment' invoked by an authenticated low-privilege panel user with read_orders permission)",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-22487ec06a8cf50a",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Shipments.php::table() record actions (markDelivered, edit) invoked via Livewire request by an authenticated low-privilege panel user with browse_orders/read_orders permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-2405022067cc6870",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail markPaidAction (Filament action 'markPaid') invoked by an authenticated low-privilege panel user with read_orders permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-29811dac402a0d13",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail archiveAction (Filament action 'archive') invoked via Livewire request to the admin order detail page; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-2aeaefee52274ee8",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Files.php store() action, invoked via Livewire request to the product edit page; attacker-controlled source is the Livewire action call and form state from any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-5481a94c34f42fbf",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Products\\Form\\Shipping::store() invoked via Livewire update request from the admin product shipping form; attacker-controlled source is the Livewire action call and form state ($this->data) submitted by any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-5a3dcf2a6b6b16c8",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Team/RolePermission::createPermissionAction (admin panel route for role permissions), invoked by an authenticated low-privilege panel user with view_users permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-5e6161ace0cb4b97",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Carriers::createCarrierAction (admin panel route rendering the Carriers Livewire component); attacker-controlled source: authenticated low-privilege panel user invoking the createCarrier Filament action with form data",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-61e951b6bcd03186",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component packages/admin/src/Livewire/Pages/Collection/Edit.php store() action, invoked via Livewire update request from the admin collection edit page by an authenticated low-privilege panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-7cc69fb293ec0e10",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Settings/Team/RolePermission::generatePermissionsAction (Filament action 'generatePermissions'), invoked by an authenticated panel user with only view_users permission; source is the Livewire action request payload (resource/group_name)",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-8769d9915b8295a9",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Currencies (route /settings/currencies) - table() ToggleColumn is_enabled, EditAction edit, and grouped bulk actions enable/disable; attacker-controlled Livewire method calls (e.g. updateTableColumnState, mountTableAction, callTableBulkAction) from an authenticated low-privilege panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-88497bd11908cf4a",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component AddVariant (packages/admin/src/Livewire/SlideOvers/AddVariant.php) form() barcode TextInput; attacker-controlled source is the barcode form field submitted via the Livewire save() action, rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-8b7021ee40c51b56",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Settings\\Legal\\PolicyForm::store() invoked via Livewire update request from the admin panel; attacker-controlled source is the authenticated low-privilege panel user's Livewire request payload (form state) reaching $this->legal->update()",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-91023b586e4ab747",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Shopper\\Livewire\\Components\\Settings\\Team\\Permissions::togglePermission invoked via Livewire update request from the admin panel Team/RolePermission UI",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-995f958bcb3b415b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\PaymentMethods::createPaymentAction (admin panel route for payment methods settings); attacker-controlled source: authenticated low-privilege panel user invoking the createPayment Livewire action",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-a413505de3d037f8",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Seo.php store() action, invoked via Livewire request to the product SEO form; attacker-controlled source is the Livewire component action call and form state from any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-a82b452965e2ffe5",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component packages/admin/src/Livewire/SlideOvers/AddProduct.php::store() invoked via Livewire request to the AddProduct slide-over (form submit wire:target=\"store\"); attacker-controlled source is the Livewire-bound $data form state including the barcode field",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-ab37699016e7189c",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Product\\Variant::updateStockAction (admin panel product variant page); attacker-controlled source: Livewire action call with form data (sku, barcode) from an authenticated low-privilege user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-b37cd0c75b594760",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Products\\Form\\Inventory (form/table actions)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-cd42a8054fc4a7f9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Shopper\\Livewire\\Pages\\Order\\Detail::cancelOrderAction invoked via Livewire action call on the order detail page (route shopper.orders.detail); attacker-controlled source is the authenticated low-privilege panel user's Livewire action request, which only required read_orders",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-cd45e0d6604bb846",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Locations/InventoryForm::store() invoked via Livewire update request from the admin panel route shopper.settings.locations; attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-d05ad8c2776691be",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component PaymentMethods (Settings/PaymentMethods) table actions: ToggleColumn is_enabled, EditAction edit, DeleteAction delete; invoked via Livewire update endpoint by any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-d26bdca35566e799",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail::startProcessingAction (Filament action 'startProcessing') invoked by an authenticated low-privilege panel user with read_orders permission",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-deb90b541bcac1aa",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Team\\Index (route: shopper.settings.team.index) - createRoleAction invoked by any authenticated panel user; source: Livewire action call from client",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-df2391064e3c3332",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Settings/Team/Permissions::removePermission invoked via Livewire action from admin panel; source is the Livewire action parameter $id",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-ed89d9515bdaac41",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Customers\\Create::store() invoked via admin panel route shopper.customers.create (Livewire POST to /admin/customers/create); attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-f3cb66743db8d5f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component packages/admin/src/Livewire/Pages/Settings/Carriers.php (table actions: ToggleColumn is_enabled, EditAction, DeleteAction) invoked via Livewire update requests by any authenticated panel user",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "shopperlabs-shopper-fddd0d6c3c4501aa",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "bootstrap-select plugin initialization/render (client-side library); no in-repo server route or CLI handler",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "snapappointments-bootstrap-select-5d3e7953302ad040",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "spatie-laravel-medialibrary-17bc134397b9d3f7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "spatie-laravel-medialibrary-9b12f440411602e2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "supabase-auth-js-13d9df5e852b0156",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "resolveFile via loadFileDataForInput (UI server-side file resolution)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "tensorzero-tensorzero-1df57d6b5c9fc101",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-00a60694b44cad58",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-017c730f695963d1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0303c786b3f9def3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-03db63004dde1012",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0847872016dff82d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0b7c25791baf4ea7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0d903711cc0bf246",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /api/v1/schedules/:scheduleId/deactivate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-0eb72665259b13c2",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /api/v1/schedules/:scheduleId/activate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-124d417d0ae18fbe",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-1389b2b039433f1d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-1609ba0be33d1321",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-173943fa33a292d8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment(projectId, friendlyId); attacker-controlled source: deploymentId path param + secret API key of a lower-trust environment",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-2240070f2c86924b",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-23e4ffbc736b2960",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-28978c4024d4bf10",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-2ad2f0a3cde32718",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-2f8805383abee870",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (action in apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts); attacker-controlled source: API key in request headers via authenticateRequest, plus deploymentId path param",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-30dec4b7031de737",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3309f58798af795d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-33568c3becc0c84c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-34d89ac9922ed6c5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-397d55d61662dcbb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3b2daa8cc067a965",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3da6ba2954fae9e2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-428c7b244470b508",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5224c92a3bd5124b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-52d2cb11d78d0327",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5392f925c70f8c55",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-588437af67b5a758",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) with attacker-controlled secret API key (dev/preview env) and deploymentId param",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-5b0c0ef74fdf5bc3",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5c1e8b013b50f48d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment; attacker-controlled source: authenticated secret API key (environment) and deploymentId path param",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-5f1cf28e3ac84980",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-69e5a79ca434a31b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-72c9f380f92bd8f2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-7323929a73b6be76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-816142e126393220",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-874f7ae9b06d875b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-92c5190a8ba1209d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-984189f717b2a3da",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-99347f6b51258e29",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-a20e065c9b6ced3b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-b2314fca2554ca64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-b8f3fea0ac68f12c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-ca2ef47f420ef2eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-d7690485d67bf995",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-dcc34c0e95ea739c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-ddd75cb2ab0e406d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-df02f538ad370706",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-dfa82db3c18c0e1b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/$deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment; attacker-controlled source: authenticated environment secret API key (dev/preview key) plus deploymentId path param",
"fix_addresses_it": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"human_spot_check": {
"date": "2026-10-13",
"decision": "accept",
"reviewer": "mc"
},
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"id": "triggerdotdev-trigger.dev-eebfca9646e01b1c",
"model": "deepseek-flash",
"reachable_in_repo": true,
data: maintainer spot-check, 51 access control locations accepted (7 changes)
2026-10-13 18:09:10 +02:00
"verdict": "accepted",
data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check
2026-10-13 16:48:41 +02:00
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-f2588e86d347fea6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-f809e61cae1a9f29",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Affix constructor via $.fn.affix(options) or data-spy=\"affix\" data attributes; options.target passed to $(this.options.target)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-a6f8f24cd4354719",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Tooltip.prototype.init via $.fn.tooltip plugin (options.viewport / options.container)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-bfa547024b92ef59",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Collapse.prototype.getParent (options.parent selector)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-d29d2c0e551ad5e8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "web-infra-dev-rspack-c788948210260bd9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "processMessage(message, ctx) invoked from the Baileys socket message pipeline (e.g. sendMessage/ev 'messages.upsert' handling); attacker-controlled source is the incoming WAMessage.message.protocolMessage (placeholderResendMessage / PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE, HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE) delivered over the WhatsApp protocol",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "whiskeysockets-baileys-89cd6d4edf46d286",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "AuthService.handleCallback",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "workos-authkit-session-399c57ce0227249e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
}
]
}
Reference in New Issue Copy Permalink