358360d744
undf: assign UNDF-2026-000001206..000001207, stamp patches (cura-0002, prusaslicer-0004)
2026-04-03 14:16:55 -04:00
e8396e9310
undf: assign UNDF-2026-000001196..1205; stamp openscad-0002/0003, suitecrm-0005/0006, calibre-0003/0004, invoiceninja-0004/0005, xtuple-0001
2026-04-03 14:10:53 -04:00
1fda7b64d3
undf: assign UNDF-2026-000001193..1197 to suricata-0002, squid-0004, clamav-0001, pgbouncer-0002, sendmail-0001; stamp patches
2026-04-03 13:31:17 -04:00
01f059fa4b
undf: assign UNDF-2026-000001190 through UNDF-2026-000001192, stamp patches
2026-04-03 13:25:03 -04:00
5e1c00c890
undf: assign UNDF-2026-000001184 to dnsdbq-0001, stamp patch
2026-04-03 13:06:09 -04:00
93c9c175d4
undf: assign UNDF-2026-000001125 to mercurial-0001, stamp patches
2026-04-03 11:04:23 -04:00
cb3ee91292
undf: assign 1040-1056; stamp emulator wave patches (hatari/fceux/sameboy/duckstation/pcsx2/mupen64plus/mednafen/vice/fbneo/dolphin/genesis-plus-gx/ryujinx/cemu/fs-uae)
2026-03-31 18:18:58 -04:00
2a0a635c74
undf: assign 1013-1039; stamp patches (samba/juicefs/ipfs-cluster/nfs/rclone/lotus/speed-dreams/seaweedfs wave)
2026-03-31 13:27:38 -04:00
9fac7766ba
wesnoth: 3 CWE-407 defects, MOAD 0002-0005 CLEAN
...
wesnoth-0001: A* pathfinding std::find on pq vector for decrease-key
O(V*Q) per relaxation, fix: lazy deletion. HIGH, 1279x at N=5000.
wesnoth-0002: server ip_log_ deque linear scan on login/logoff
O(N) per event with N up to 500. MEDIUM, 437x at L=2000.
wesnoth-0003: combine_special_notes O(N^2) vector dedup
utils::contains on vector per note insertion. MEDIUM, 499x at N=1000.
MOAD-0002 (Intertangle): singletons deeply embedded, not actionable.
MOAD-0003 (Leaked Context): thread_local for debug/call-stack only.
MOAD-0004 (Logged Secret): passwords never logged verbatim.
MOAD-0005 (Thundering Herd): single-threaded game + coroutine server.
6/6 unit tests PASS.
2026-03-31 12:14:20 -04:00
1b98cac200
cocos2d-x: 3 CWE-407 defects, MOAD 0002-0005 CLEAN
...
cocos2d-0001: EventDispatcher _toRemovedListeners std::find O(L*R) MEDIUM 2.4x
cocos2d-0002: PhysicsWorld collisionBeginCallback std::find O(J_body*J_world) MEDIUM 11.6x
cocos2d-0003: BoneNode::visit _boneSkins.contains O(C*S) per frame MEDIUM 7.3x
MOAD-0002 (Intertangle): heavy singleton pattern (Director, etc.) but architectural, not patchable
MOAD-0003 (Leaked Context): no thread_local usage, CLEAN
MOAD-0004 (Logged Secret): no credential logging, CLEAN
MOAD-0005 (Thundering Herd): TextureCache uses unordered_map, CLEAN
6/6 unit tests PASS.
2026-03-31 12:10:19 -04:00
b3e48a3ca1
undf: assign 967-968; stamp openttd patches
2026-03-31 12:09:45 -04:00
223ccb3fee
0ad: 4 defects, 5-MOAD scan across pathfinding/visibility/templates/lobby
...
0ad-0001 CCmpObstructionManager dirty shapes vector+std::find O(N*D) HIGH 4.1x
0ad-0002 CCmpRangeManager m_ModifiedEntities vector+std::find O(E*M) HIGH 25.8x
0ad-0003 CCmpTemplateManager FindUsedTemplates vector+std::find O(T^2) MEDIUM 5.9x
0ad-0004 XmppClient+NetServer lobby auth token logged verbatim CWE-312 MEDIUM
MOAD-0002 (Intertangle): g_ globals are deliberate single-thread game arch, CLEAN
MOAD-0003 (Leaked Context): thread_local properly scoped, CLEAN
MOAD-0005 (Thundering Herd): single-threaded sim, no cache stampede, CLEAN
4/4 unit tests PASS, UNDF 956-959
2026-03-31 11:58:37 -04:00
b7340f0b9b
undf: assign 954-955; veloren-0001 TradePricing O(N^2) CWE-407, veloren-0002 auth token logged CWE-312
2026-03-31 11:48:12 -04:00
9335217e94
jellyfin-0001/jellyfin-0002: Jellyfin 5-MOAD scan
...
jellyfin-0001 (CWE-407): BaseNfoSaver AddCustomTags xmlTagsUsed List.Contains
O(E*T) per NFO save, fix HashSet O(E). 24.6x at T=50,E=200. UNDF-2026-000000952.
jellyfin-0002 (CWE-312): Logged secrets in SessionManager (access token),
SchedulesDirect (auth token), QuickConnectManager (secret). 3 sites. UNDF-2026-000000953.
MOAD-0002 (Intertangle): CLEAN. No god object pattern detected.
MOAD-0003 (Leaked Context): CLEAN. AsyncLocal only for deadlock detection.
MOAD-0005 (Thundering Herd): CLEAN. FastConcurrentLru with GetOrAdd.
2026-03-31 11:46:30 -04:00
f85ccf9b99
open-webui-0001: CWE-312 logged secret in PersistentConfig Redis sync
...
AppConfig.__getattr__ logs raw decoded values when config keys change
via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+
other API key/token/password PersistentConfig entries. Fix: redact
values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist.
13/13 PASS
2026-03-31 11:43:57 -04:00
a7907f0e12
supertuxkart-0001: item_manager randomItemsForArena O(N^2) invalid_location scan
...
CWE-407 defect in src/items/item_manager.cpp:635. std::find on
std::vector<int> invalid_location inside retry loop inside placement
loop. Fix: std::unordered_set<int> for O(1) membership. 13.8x at N=500.
MOAD-0002 through MOAD-0005 scanned CLEAN:
- MOAD-0002 (Intertangle): standard game engine singleton pattern
- MOAD-0003 (Leaked Context): thread_local g_process_type is process-scoped
- MOAD-0004 (Logged Secret): HTTP request logging already has credential denylist
- MOAD-0005 (Thundering Herd): no shared cache patterns in network code
2026-03-31 10:09:46 -04:00
8ea8ad434f
undf: assign 935-937; cataclysm-dda 3 CWE-407 defects
...
cataclysm-0001: overmap_ui search dedup vector O(P*M), 79x
cataclysm-0002: dependency_tree dedup vector O(N^2), 2x
cataclysm-0003: surroundings_menu item/terfurn dedup O(N^2), 9x
2026-03-31 10:08:23 -04:00
3c1ab5459c
undf: assign 941-943; stamp monogame patches
2026-03-31 10:07:59 -04:00
c2a1fc15cc
undf: assign 928-930; btcpayserver CWE-407 scan (3 defects)
...
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM
btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM
btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
2026-03-31 09:39:59 -04:00
995cd9af22
undf: assign 925-927; stamp cake_wallet patches
2026-03-31 09:16:17 -04:00
b62fd27e28
undf: assign 920-922; stamp wasabi patches
2026-03-31 09:13:59 -04:00
737891b5a1
undf: assign 917; stamp bcoin patch
2026-03-31 09:13:04 -04:00
36f9dd6a51
undf: assign 915-916; stamp wekan patches
2026-03-31 08:06:03 -04:00
3c3f9639cf
undf: assign 908-914; stamp transformers/ray-project/dask-project patches
2026-03-31 07:48:39 -04:00
0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
a4a1e444e6
undf: assign 741-880; stamp patches; generate_undf.py sync
2026-03-30 16:52:36 -04:00
494d1c82a3
undf: assign UNDF numbers, stamp patches; 878 total
2026-03-30 16:46:38 -04:00
8b5e3c35b1
undf: assign UNDF numbers, stamp patches; 875 total
2026-03-30 16:45:00 -04:00
7e717432dd
undf: assign UNDF-2026-000000874; stamp vllm-0001 patch
2026-03-30 16:42:12 -04:00
15db2a0269
synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN
...
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
2026-03-30 15:23:53 -04:00
dd20794faa
undf: assign 859-861; stamp patches; element-web-0003/element-web-0004/conduit-0001
2026-03-30 15:17:08 -04:00
2372d29c88
undf: assign UNDF-2026-000000858 for proxysql-0001; stamp patch
2026-03-30 14:59:38 -04:00
c31c569e45
undf: stamp gitlab-foss patches with UNDF numbers
2026-03-30 14:56:23 -04:00
4cc47349a5
undf: assign 847-849; stamp freecad/retroarch patches
2026-03-30 14:53:28 -04:00
0d852be0a3
undf: assign 845-846; stamp firefox patches
2026-03-30 14:51:42 -04:00
558f0d30c2
undf: stamp clementine patches (UNDF-2026-000000841..842)
2026-03-30 14:43:28 -04:00
fb2c48dc37
undf: stamp kdenlive-0005..0008 (UNDF-2026-000000835..838)
2026-03-30 14:40:29 -04:00
9bdea940fc
undf: assign 828-832; stamp patches; tomcat-0001/hibernate-orm-0001/netty-0001/netty-0002
2026-03-30 13:55:42 -04:00
7f2c2a1a36
undf: assign UNDF-2026-000000823; stamp terraform-0001/ansible-0002/ansible-0003
2026-03-30 13:29:54 -04:00
3d2957276d
undf: assign UNDF-2026-000000822; stamp telegraf-0001 patch
2026-03-30 13:28:35 -04:00
2ccaf9e7fa
undf: assign UNDF-2026-000000821; stamp loki-0001 patch
2026-03-30 13:18:59 -04:00
cf2c734de1
undf: assign UNDF-2026-000000819 through 000000820; rename hive-0004/hive-0005; stamp patches
2026-03-30 13:17:14 -04:00
4f51d81913
undf: assign UNDF-2026-000000815 through 000000817; stamp superset patches
2026-03-30 13:04:50 -04:00
9b3008a2b1
undf: assign UNDF-2026-000000813; stamp neovim-0001 patch
2026-03-30 11:46:05 -04:00
