Vulnerability catalog
140 curated vulnerability families with a concrete test, evidence threshold, false-positive check, and reverse references. This is a broad, extensible field index; no finite catalog can enumerate every product-specific flaw or attack chain. CWE references describe candidate weakness classes, not a definitive root-cause assignment. MITRE CWE provides the broader taxonomy.
No matching entries. Clear a filter or try a broader term.
CWE-639
Broken object-level authorization (BOLA / IDOR)
An actor can access another owner’s protected object by supplying its identifier.
ATT&CK: no direct mapping selected
CWE-862 · CWE-863
Broken function-level authorization (BFLA)
A lower-privilege actor invokes a function reserved for another role.
ATT&CK: no direct mapping selected
CWE-862 · CWE-863
Broken property authorization: private response fields
An otherwise permitted object response includes fields the actor is not entitled to read.
ATT&CK: no direct mapping selected
CWE-915
Mass assignment of server-controlled properties
Automatic request binding lets a user modify a property that should be set only by trusted server logic.
ATT&CK: no direct mapping selected
CWE-287
Authentication or MFA state bypass
A session that has not completed required authentication can perform protected operations.
ATT&CK: no direct mapping selected
CWE-384
Session fixation across login
A session known to an attacker remains usable after another controlled user authenticates into it.
Conditional ATT&CK: T1550.004
CWE-613
Residual access after explicit session revocation
A revoked credential or removed membership retains access beyond the product’s applicable revocation guarantee.
Conditional ATT&CK: T1550.004
CWE-640
Password reset binding or single-use failure
Recovery proof can change the wrong account or be reused contrary to the recovery contract.
ATT&CK: no direct mapping selected
CWE-287 · CWE-352
OAuth login or account-linking confusion
An authorization response or external identity is bound to the wrong application session or controlled account.
ATT&CK: no direct mapping selected
CWE-347 · CWE-287
JWT signature, issuer, audience, or token-purpose validation failure
A service accepts token claims without the required signature or trusted issuer/key validation.
ATT&CK: no direct mapping selected
CWE-89
SQL injection
Input changes SQL query structure instead of remaining a bound value.
ATT&CK: no direct mapping selected
CWE-943
NoSQL operator or query injection
An unexpected object, operator, or expression crosses a NoSQL query boundary.
ATT&CK: no direct mapping selected
CWE-78
OS command injection
An untrusted parameter becomes shell command syntax rather than remaining a data argument.
Conditional ATT&CK: T1190, T1059.004
CWE-1336
Server-side template injection (SSTI)
Lower-trust data becomes executable template source at a server-side renderer.
Conditional ATT&CK: T1190
CWE-79
Reflected or stored cross-site scripting
Attacker-controlled input executes in another controlled user’s browser under the application origin.
Conditional ATT&CK: T1539
CWE-79
DOM-based cross-site scripting
Browser-side code moves attacker-controlled data into an executable DOM or script sink.
ATT&CK: no direct mapping selected
CWE-352
Cross-site request forgery (CSRF)
A browser can be induced to perform a protected state change using ambient credentials.
ATT&CK: no direct mapping selected
CWE-942
CORS private-data exposure
A lower-trust origin can read a protected response using the controlled user’s browser credentials.
ATT&CK: no direct mapping selected
CWE-346
Cross-origin messaging trust failure
A message handler trusts an unauthorized sender or leaks protected data to an unintended origin.
ATT&CK: no direct mapping selected
CWE-918
Server-side request forgery (SSRF)
A server-side fetch crosses the feature’s destination, network, or credential policy.
Conditional ATT&CK: T1552.005
CWE-434
Unsafe upload interpretation or placement
Uploaded content is handled in a security-sensitive context beyond its permitted file contract.
ATT&CK: no direct mapping selected
CWE-22
Path traversal outside an allowed root
A controlled path escapes the intended filesystem or object-key boundary.
ATT&CK: no direct mapping selected
CWE-611
XML external entity injection (XXE)
An XML parser resolves untrusted external entities across an unintended file or network boundary.
ATT&CK: no direct mapping selected
CWE-22
Archive extraction path escape
An archive member is extracted outside its designated output directory.
ATT&CK: no direct mapping selected
CWE-349
Web cache poisoning
Unkeyed attacker-controlled input changes a representation later served from shared cache.
ATT&CK: no direct mapping selected
CWE-524
Web cache deception
A path/cache-policy discrepancy stores a private response for retrieval by another client.
ATT&CK: no direct mapping selected
CWE-444
HTTP request smuggling / desynchronization
Two HTTP-processing components disagree about request boundaries or parsing.
ATT&CK: no direct mapping selected
CWE-362
Race condition in a security-sensitive transition
Concurrent operations violate a rule that holds when the same actions run serially.
ATT&CK: no direct mapping selected
CWE-841
Workflow order or approval bypass
An actor can complete a protected workflow without its required prior approval or immutable conditions.
ATT&CK: no direct mapping selected
CWE-837
Single-use action or idempotency replay failure
A replay creates another protected effect where the operation must be unique or idempotent.
ATT&CK: no direct mapping selected
CWE-863
GraphQL resolver or field authorization failure
A GraphQL path or protected field bypasses the permission enforced for the same object elsewhere.
ATT&CK: no direct mapping selected
CWE-862
WebSocket message or subscription authorization failure
A valid connection performs unauthorized per-message actions or receives a private subscription.
ATT&CK: no direct mapping selected
CWE-346 · CWE-352
Cross-site WebSocket hijacking
A page on another origin opens an authenticated socket and reads or performs protected operations.
ATT&CK: no direct mapping selected
CWE-798
Hard-coded product credentials
A reusable credential is embedded in source, history, a release, or a default configuration. Distinguish a shared built-in credential from an accidentally committed deployment credential when assigning the weakness.
Conditional ATT&CK: T1552.001
CWE-94
CI metadata interpreted as executable script
Pull-request titles, branch metadata, issue fields, or artifact values are inserted into a generated shell/program instead of being handled as data.
Conditional ATT&CK: T1059.004, T1195.002
CWE-829
Untrusted contribution executed by privileged CI
A trusted workflow fetches or loads contribution-controlled code, configuration, or dependencies and executes them with authority unavailable to the contributor.
Conditional ATT&CK: T1195.001, T1195.002
CWE-829
CI artifact poisoning across a workflow trust boundary
A higher-trust workflow treats attacker-controlled test/build output as executable code or authoritative release input without adequate producer and content constraints.
Conditional ATT&CK: T1195.002
CWE-829
Dependency confusion and unintended package origin
Dependency resolution selects an attacker-controlled package origin where the build or application expects an organization-controlled package.
Conditional ATT&CK: T1195.001
CWE-502
Unsafe object deserialization
Untrusted bytes reach a format that can instantiate behavior-bearing objects or invoke code, such as Python pickle, without a sufficient trust boundary.
Conditional ATT&CK: T1190, T1203
CWE-1321
JavaScript prototype pollution
An attacker-controlled property path changes inherited object state, which can affect unrelated objects and security-sensitive consumers.
ATT&CK: no direct mapping selected
CWE-125
Out-of-bounds memory read
A parser or native consumer reads outside the valid extent of an object or buffer, potentially causing a crash or disclosure depending on how the result is used.
ATT&CK: no direct mapping selected
CWE-787
Out-of-bounds memory write
A native component writes beyond an allocated object because length, index, or allocation assumptions do not agree.
Conditional ATT&CK: T1203, T1068
CWE-416
Use after free in a public API or parser lifecycle
Code uses an object after its lifetime has ended, often across callbacks, error handling, reference counting, or asynchronous operations.
Conditional ATT&CK: T1203, T1068
CWE-190
Integer overflow affecting allocation or bounds
Input-derived arithmetic wraps or overflows so the checked size, allocation size, and later operation refer to different effective values.
ATT&CK: no direct mapping selected
CWE-400
Parser resource exhaustion and decompression amplification
A small accepted input causes disproportionate CPU, memory, recursion, or expanded output consumption without effective limits at the relevant consumer.
ATT&CK: no direct mapping selected
CWE-1333
Regular-expression denial of service
An attacker-controlled string makes the chosen regular-expression engine perform excessive backtracking or other disproportionate matching work.
ATT&CK: no direct mapping selected
CWE-377
Predictable temporary files and unsafe creation
A component creates or reuses temporary files in a way that permits another local principal to precreate, replace, read, or redirect sensitive operations.
ATT&CK: no direct mapping selected
CWE-427
Untrusted executable, library, or module search path
A program resolves an executable/library/module from an attacker-writable search location instead of the intended trusted component.
Conditional ATT&CK: T1068
CWE-863
Overbroad cloud role trust
A principal outside the integration's intended trust set can obtain an owned role's authority.
Conditional ATT&CK: T1078.004
CWE-266
Excessive service-role delegation
A restricted principal can cause an allowed service to execute with a more powerful role than the application contract permits.
ATT&CK: no direct mapping selected
CWE-863
Federated cloud role accepts the wrong workload identity
OIDC role trust accepts a legitimate token from a disallowed controlled subject, repository, branch or audience.
Conditional ATT&CK: T1078.004
CWE-732
Anonymous access to private object storage
An unsigned request retrieves an object that the product promises to keep private.
Conditional ATT&CK: T1530
CWE-732
Unauthorized object creation or replacement
An unauthorized principal can create or replace an object in a protected storage location.
ATT&CK: no direct mapping selected
CWE-863
Signed storage capability exceeds its authorized scope
The application issues or accepts a storage capability for an object, operation or lifetime beyond the caller's entitlement.
Conditional ATT&CK: T1530
CWE-862
Private delivery policy bypassed through the origin
A private object is protected at the CDN or application edge but remains accessible directly at an owned origin.
ATT&CK: no direct mapping selected
CWE-732
Kubernetes Secret access exceeds tenant permissions
A restricted cluster principal can read a canary Secret outside its intended resource boundary.
ATT&CK: no direct mapping selected
CWE-266
Workload creation grants unintended service-account authority
An allowed workload-creation path lets a tenant select a service account or resource mount exceeding its promised permissions.
ATT&CK: no direct mapping selected
CWE-863
Admission policy misses a supported object or update path
A tenant can persist an object prohibited by the advertised admission policy through a missed operation, selector or subresource.
ATT&CK: no direct mapping selected
CWE-923
Namespace or workload network restriction is ineffective
A disallowed fixture workload reaches a service across a network boundary that the deployment claims to enforce.
ATT&CK: no direct mapping selected
CWE-250
Container exposes unintended host files or privileges
A supported container configuration gives an untrusted workload access to host resources outside the documented isolation boundary.
Conditional ATT&CK: T1611
CWE-522
Sensitive values exposed through state or plan artifacts
A deployment artifact readable by an unintended principal contains credentials or equivalent confidential material.
Conditional ATT&CK: T1552.001
CWE-522
Secrets retained in container build artifacts
A build places confidential inputs in image history, layers or artifacts available outside their intended audience.
Conditional ATT&CK: T1552.001
CWE-276
Supported deployment default exposes a protected service
A supported installation path creates permissive service exposure or permissions that contradict the product's stated deployment boundary.
ATT&CK: no direct mapping selected
CWE-672
Dangling DNS reference to a retired service
An owned hostname still points to a released provider resource, creating a possible takeover path if provider binding rules permit it.
ATT&CK: no direct mapping selected
CWE-732
Restricted DNS zone transferable from an unintended source
An unauthorized source can retrieve an entire zone that the owner intends to restrict.
ATT&CK: no direct mapping selected
CWE-862 · CWE-863
DNS recursion available outside the intended client network
A resolver performs recursive lookups for a client excluded by its intended access policy.
ATT&CK: no direct mapping selected
CWE-441
SMTP relay allows unauthenticated external delivery
An untrusted unauthenticated client can relay between external domains contrary to the server's relay policy.
ATT&CK: no direct mapping selected
CWE-862 · CWE-863
Redis authentication or key ACL boundary failure
An anonymous or restricted client can read a key outside the service's intended access policy.
ATT&CK: no direct mapping selected
CWE-306
PostgreSQL trust authentication exceeds the approved network boundary
An unintended source can connect as a protected database identity without the required authentication because an effective trust rule applies.
ATT&CK: no direct mapping selected
CWE-863
Message broker permissions cross a virtual-host boundary
A restricted broker identity can act on a queue or exchange belonging to a different isolated fixture tenant.
ATT&CK: no direct mapping selected
CWE-306
Container daemon management endpoint lacks required client authentication
An untrusted network client reaches protected container-management functionality without the required identity checks.
ATT&CK: no direct mapping selected
CWE-926
Exported Android component exposes a protected operation
An externally reachable activity, service or receiver performs work that its caller is not entitled to request.
ATT&CK: no direct mapping selected
CWE-926 · CWE-863
Content-provider permission or URI-grant escape
A recipient obtains data or file capabilities beyond the URI and permissions deliberately shared with it.
ATT&CK: no direct mapping selected
CWE-441
Nested intent redirects application authority
An exported entry point forwards attacker-supplied intent fields into a protected destination using the target application’s authority.
ATT&CK: no direct mapping selected
CWE-863
PendingIntent grants unintended mutable or replayable authority
A recipient can alter or reuse a delegated action beyond its intended destination, parameters or lifetime.
ATT&CK: no direct mapping selected
CWE-939 · CWE-863
Mobile link handler trusts routing as authorization
An externally supplied custom or universal/app link reaches a protected client operation without validating the route input and current security context.
ATT&CK: no direct mapping selected
CWE-749
Untrusted WebView content reaches a native bridge
A page or frame controlled outside the trusted app origin can invoke native capabilities through a shipped WebView bridge.
ATT&CK: no direct mapping selected
CWE-922
Keychain accessibility violates the intended lock boundary
A sensitive item or protected key operation is available in a device state that the application’s security policy requires it to deny.
ATT&CK: no direct mapping selected
CWE-863
Extension input crosses an iOS shared-container boundary
The main application trusts content written through a lower-trust extension/input path as if it were an authorized app action.
ATT&CK: no direct mapping selected
CWE-288
Local authentication does not gate the protected operation
A local PIN or biometric screen is bypassed through another reachable path while the supposedly protected data/key operation remains usable.
ATT&CK: no direct mapping selected
CWE-530 · CWE-922
Backup or transfer exposes unintended sensitive client state
A supported backup, migration or diagnostic-copy path carries a secret into an unintended recipient or security context.
ATT&CK: no direct mapping selected
CWE-532
Sensitive client state leaks through accessible diagnostics
Logs, crash reports or user-exportable diagnostics disclose a secret or private record to a principal outside its intended audience.
Conditional ATT&CK: T1552.001
CWE-295 · CWE-297
TLS peer certificate or hostname verification failure
Release trust validation accepts an untrusted certificate chain or wrong-host identity on a sensitive connection.
ATT&CK: no direct mapping selected
CWE-749 · CWE-863
Electron IPC exposes main-process authority to an untrusted sender
An attacker-controlled renderer or frame invokes a privileged main-process operation through insufficient sender or argument validation.
Conditional ATT&CK: T1203
CWE-88
Desktop protocol handler misinterprets external input
An OS-dispatched URL reaches a native command or operation with attacker-controlled arguments outside the intended handler contract.
Conditional ATT&CK: T1203
CWE-494 · CWE-347
Updater accepts an artifact outside its publisher trust policy
The real update decision accepts modified bytes or an unrelated publisher identity before activation.
Conditional ATT&CK: T1195.002
CWE-732 · CWE-367
Privileged updater consumes lower-user-controlled staging content
A standard user can replace a staged file or redirect a path actually consumed by a privileged installation process.
Conditional ATT&CK: T1068
CWE-863
Attacker-controlled rollback restores a prohibited security state
An attacker bypasses an update version authorization policy to cause a rollback that restores a prohibited security state.
ATT&CK: no direct mapping selected
CWE-1427
Indirect prompt injection into protected tool actions
Lower-trust retrieved content influences the agent into a tool operation outside the legitimate task or granted authority.
ATT&CK: no direct mapping selected
CWE-863
Agent tool accepts unauthorized object or tenant parameters
A tool trusts caller-supplied object or workspace identifiers instead of enforcing the authenticated principal’s authority.
ATT&CK: no direct mapping selected
CWE-367
Agent approval is not bound to executed arguments
An approved harmless action can be modified before dispatch without revalidating the approval’s scope.
ATT&CK: no direct mapping selected
CWE-441
MCP proxy consent confuses different clients
A proxy reuses upstream consent in a way that grants a new MCP client access without the resource owner’s intended per-client consent.
ATT&CK: no direct mapping selected
CWE-287
MCP accepts a token for another resource
A protected MCP resource accepts a token that was not issued for that resource.
Conditional ATT&CK: T1550.001
CWE-863
RAG retrieval or citation resolver crosses tenant boundaries
Search filters, chunk retrieval or citation download omit an ownership decision required for the effective caller.
ATT&CK: no direct mapping selected
CWE-863
RAG cache or fresh retrieval ignores revoked access
A new retrieval or cache response exposes protected content after its applicable permission revocation has taken effect.
ATT&CK: no direct mapping selected
CWE-1265
Contract callback reentrancy violates a state invariant
Nested calls observe or alter state under assumptions that do not hold while an earlier operation is incomplete.
ATT&CK: no direct mapping selected
CWE-862
Contract initializer permits unauthorized ownership or configuration
A reachable initialization path lets an ordinary actor establish or replace privileged state outside the intended deployment lifecycle.
ATT&CK: no direct mapping selected
CWE-862
Contract upgrade authority can be bypassed
An actor outside the upgrade policy can change a proxy’s execution target or equivalent privileged configuration.
ATT&CK: no direct mapping selected
CWE-682
Vault share conversion or rounding breaks entitlement
Conversions, fees or rounding create an unintended claim on assets or an eligible loss under supported token behavior.
ATT&CK: no direct mapping selected
CWE-294
Signed contract action can be replayed unexpectedly
A successfully consumed authorization remains reusable despite a one-use or otherwise bounded execution contract.
ATT&CK: no direct mapping selected
CWE-345
Signed action does not bind its intended context
A valid signature is accepted for another recipient, action, verifier or chain context contrary to the authorization contract.
ATT&CK: no direct mapping selected
CWE-754
Oracle freshness or dependency state permits an invalid decision
A consumer accepts an observation outside its required freshness or availability conditions and makes an incorrect economic decision.
ATT&CK: no direct mapping selected
CWE-682
Oracle denomination or decimal conversion is incorrect
The consumer mixes quote currencies, token precision or feed precision and assigns the wrong economic value.
ATT&CK: no direct mapping selected
CWE-347
Firmware verifier accepts unauthenticated protected bytes
The relevant update acceptance path fails to authenticate executable payload or security-relevant metadata correctly.
Conditional ATT&CK: T1542.001, T1542.002
CWE-1328
Firmware security-version state can be lowered
An attacker can reduce the protected security version and thereby restore software excluded by the anti-rollback policy.
ATT&CK: no direct mapping selected
CWE-20
Firmware verification fails to enforce required product binding
An otherwise authentic image is accepted for an incompatible product or security configuration despite required target restrictions.
ATT&CK: no direct mapping selected
CWE-345
Boot or recovery path executes an unverified component
A reachable boot path omits an authenticity check required by the product’s execution trust model.
Conditional ATT&CK: T1542.001, T1542.002
CWE-306
Production UART exposes an unauthenticated privileged console
The in-scope physical access model yields a protected console capability without required authentication.
ATT&CK: no direct mapping selected
CWE-1191
On-chip debug interface exposes protected memory or control
A production debug/test interface permits a protected capability beyond the documented physical-access authorization.
ATT&CK: no direct mapping selected
CWE-798
Firmware contains a reusable shared authentication credential
An attacker-accessible firmware artifact embeds a credential that grants protected access, potentially across multiple devices.
Conditional ATT&CK: T1552.001
CWE-540
Exposed repository or history secret
Source, history, or a published artifact exposes a credential outside its intended audience.
Conditional ATT&CK: T1552.001
CWE-601
Open redirect across an origin trust boundary
Attacker input controls a navigation destination that the application treats as trusted.
ATT&CK: no direct mapping selected
CWE-1021
Clickjacking of a sensitive authenticated action
An untrusted origin can frame and visually disguise an authenticated operation.
ATT&CK: no direct mapping selected
CWE-346
Untrusted Host or forwarding-header origin construction
The application constructs a security-sensitive origin from request metadata that an attacker can influence.
ATT&CK: no direct mapping selected
CWE-209
Sensitive data in errors, debug routes, or generated files
An error or debug output crosses a confidentiality boundary by revealing protected state.
ATT&CK: no direct mapping selected
CWE-338
Predictable security token or capability identifier
A security token relies on randomness that does not meet its unpredictability requirement.
ATT&CK: no direct mapping selected
CWE-916
Password storage without an adequate adaptive hash
A password verifier has insufficient computational cost for its supported threat model.
ATT&CK: no direct mapping selected
CWE-353
Encrypted data accepted without integrity authentication
A protected data format permits security-relevant changes that are not detected before use.
ATT&CK: no direct mapping selected
CWE-347 · CWE-287
SAML assertion signature, audience, or response binding failure
The service provider trusts an assertion whose signature or authentication context is not valid for the receiving flow.
ATT&CK: no direct mapping selected
CWE-287
Unauthorized authenticator enrollment, replacement, or removal
A lower-assurance or wrong-account context can add, replace, or remove an authentication factor contrary to its management policy.
ATT&CK: no direct mapping selected
CWE-287 · CWE-347
WebAuthn assertion accepted for an invalid account or ceremony context
The relying party accepts a passkey assertion without the required account, challenge, signature, origin, or verification binding.
ATT&CK: no direct mapping selected
CWE-287
Verification or account merge preserves another actor's access
Registration, verification, email change, or federation merging transfers trust to an identity while retaining an unintended actor's usable credentials or session.
ATT&CK: no direct mapping selected
CWE-288
Enforced SSO bypass through an alternate login path
A protected tenant requiring federation remains accessible through a local or alternate authentication path outside the documented exceptions.
ATT&CK: no direct mapping selected
CWE-88
Argument or option injection without shell interpretation
A value-only input changes options or mode of the intended executable, even when no shell is used.
ATT&CK: no direct mapping selected
CWE-436
Parameter or JSON parser disagreement crosses a security check
Validation or authorization uses one interpretation of a request value while the protected operation uses another.
ATT&CK: no direct mapping selected
CWE-235
Server-side parameter pollution in a constructed request
An outer input injects or alters parameters in a server-created downstream request.
ATT&CK: no direct mapping selected
CWE-345
Unverified or tampered webhook causes a protected effect
An event is processed with privileged consequences without establishing the required sender and content authenticity.
ATT&CK: no direct mapping selected
CWE-863
Authentic integration event applied to the wrong tenant or object
A valid provider event is misbound to a local tenant, installation, mode or resource the event is not authorized to modify.
ATT&CK: no direct mapping selected
CWE-863
GitLab job token crosses an unintended project boundary
A contribution-controlled job acquires access to a private receiving-project resource beyond the CI integration contract.
ATT&CK: no direct mapping selected
CWE-668
Shared CI runner exposes private state across jobs
A job reaches a previous job's private filesystem or image material despite the runner's promised isolation.
ATT&CK: no direct mapping selected
CWE-441 · CWE-863
Page message borrows unintended browser-extension authority
An ordinary web page reaches a privileged extension action through insufficient message sender or argument validation.
ATT&CK: no direct mapping selected
CWE-367 · CWE-863
Delayed extension result reaches a different document
An asynchronous extension operation reuses stale tab/frame authority after navigation and exposes a protected result to another document.
ATT&CK: no direct mapping selected
CWE-863
Agent conversation, checkpoint or memory crosses ownership boundaries
Persisted agent state or its resume/export path is accessible or mutable by a principal outside its intended owner or sharing grant.
ATT&CK: no direct mapping selected
CWE-345 · CWE-863
MCP resumed state changes authorization or request meaning
An MRTR server trusts modified or context-mismatched requestState when it affects a protected resumed operation.
ATT&CK: no direct mapping selected
CWE-524 · CWE-863
Private MCP result is reused across authorization contexts
A shared cache delivers caller-specific protocol data outside the authorization context that produced it.
ATT&CK: no direct mapping selected
CWE-841
Agent retry commits a protected single-use action twice
A response-loss or resume path duplicates an operation whose application contract requires at-most-once effect.
ATT&CK: no direct mapping selected
Context-specific weakness
Private client content leaks through a lower-trust display or sharing channel
A private marker appears in a notification, background snapshot, clipboard or another user-visible channel outside its promised audience.
ATT&CK: no direct mapping selected
CWE-502 · CWE-829
Untrusted model artifact reaches executable deserialization or custom code
An attacker-controlled artifact reaches a loader whose execution trust exceeds the uploader's intended data-only authority.
ATT&CK: no direct mapping selected
CWE-770
Unbounded resource allocation or request amplification
An operation consumes an unconstrained protected resource through input size, fan-out, queued work, output size or retries.
ATT&CK: no direct mapping selected
CWE-799
Sensitive business flow exceeds its permitted frequency or allocation
An actor exceeds an intended recipient, reservation, workflow or tenant allocation through repeated otherwise valid operations.
ATT&CK: no direct mapping selected
Coverage at a glance#
Documentation coverage, not vulnerability prevalence or tests completed. An entry may apply to several families.
OSS & self-hosted113Web & API69Network services20Mobile60Desktop & extensions63Cloud & containers60AI, agents & MCP50Web3 & protocols11Hardware & firmware15Use a catalog entry#
Read the hypothesis and false positives; follow its linked module for setup, exact steps, commands, and controls. An ATT&CK badge is a conditional behavior reference, not a claim that every instance of this vulnerability exhibits that technique. Mark an absent mapping as “not established” rather than forcing a match.