b7340f0b9b
undf: assign 954-955; veloren-0001 TradePricing O(N^2) CWE-407, veloren-0002 auth token logged CWE-312
2026-03-31 11:48:12 -04:00
9335217e94
jellyfin-0001/jellyfin-0002: Jellyfin 5-MOAD scan
...
jellyfin-0001 (CWE-407): BaseNfoSaver AddCustomTags xmlTagsUsed List.Contains
O(E*T) per NFO save, fix HashSet O(E). 24.6x at T=50,E=200. UNDF-2026-000000952.
jellyfin-0002 (CWE-312): Logged secrets in SessionManager (access token),
SchedulesDirect (auth token), QuickConnectManager (secret). 3 sites. UNDF-2026-000000953.
MOAD-0002 (Intertangle): CLEAN. No god object pattern detected.
MOAD-0003 (Leaked Context): CLEAN. AsyncLocal only for deadlock detection.
MOAD-0005 (Thundering Herd): CLEAN. FastConcurrentLru with GetOrAdd.
2026-03-31 11:46:30 -04:00
f85ccf9b99
open-webui-0001: CWE-312 logged secret in PersistentConfig Redis sync
...
AppConfig.__getattr__ logs raw decoded values when config keys change
via Redis, including OPENAI_API_KEYS, GOOGLE_CLIENT_SECRET, and 20+
other API key/token/password PersistentConfig entries. Fix: redact
values for keys matching SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL denylist.
13/13 PASS
2026-03-31 11:43:57 -04:00
a7907f0e12
supertuxkart-0001: item_manager randomItemsForArena O(N^2) invalid_location scan
...
CWE-407 defect in src/items/item_manager.cpp:635. std::find on
std::vector<int> invalid_location inside retry loop inside placement
loop. Fix: std::unordered_set<int> for O(1) membership. 13.8x at N=500.
MOAD-0002 through MOAD-0005 scanned CLEAN:
- MOAD-0002 (Intertangle): standard game engine singleton pattern
- MOAD-0003 (Leaked Context): thread_local g_process_type is process-scoped
- MOAD-0004 (Logged Secret): HTTP request logging already has credential denylist
- MOAD-0005 (Thundering Herd): no shared cache patterns in network code
2026-03-31 10:09:46 -04:00
8ea8ad434f
undf: assign 935-937; cataclysm-dda 3 CWE-407 defects
...
cataclysm-0001: overmap_ui search dedup vector O(P*M), 79x
cataclysm-0002: dependency_tree dedup vector O(N^2), 2x
cataclysm-0003: surroundings_menu item/terfurn dedup O(N^2), 9x
2026-03-31 10:08:23 -04:00
3c1ab5459c
undf: assign 941-943; stamp monogame patches
2026-03-31 10:07:59 -04:00
c2a1fc15cc
undf: assign 928-930; btcpayserver CWE-407 scan (3 defects)
...
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM
btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM
btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
2026-03-31 09:39:59 -04:00
995cd9af22
undf: assign 925-927; stamp cake_wallet patches
2026-03-31 09:16:17 -04:00
b62fd27e28
undf: assign 920-922; stamp wasabi patches
2026-03-31 09:13:59 -04:00
737891b5a1
undf: assign 917; stamp bcoin patch
2026-03-31 09:13:04 -04:00
36f9dd6a51
undf: assign 915-916; stamp wekan patches
2026-03-31 08:06:03 -04:00
3c3f9639cf
undf: assign 908-914; stamp transformers/ray-project/dask-project patches
2026-03-31 07:48:39 -04:00
0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
a4a1e444e6
undf: assign 741-880; stamp patches; generate_undf.py sync
2026-03-30 16:52:36 -04:00
494d1c82a3
undf: assign UNDF numbers, stamp patches; 878 total
2026-03-30 16:46:38 -04:00
8b5e3c35b1
undf: assign UNDF numbers, stamp patches; 875 total
2026-03-30 16:45:00 -04:00
7e717432dd
undf: assign UNDF-2026-000000874; stamp vllm-0001 patch
2026-03-30 16:42:12 -04:00
15db2a0269
synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN
...
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
2026-03-30 15:23:53 -04:00
dd20794faa
undf: assign 859-861; stamp patches; element-web-0003/element-web-0004/conduit-0001
2026-03-30 15:17:08 -04:00
2372d29c88
undf: assign UNDF-2026-000000858 for proxysql-0001; stamp patch
2026-03-30 14:59:38 -04:00
c31c569e45
undf: stamp gitlab-foss patches with UNDF numbers
2026-03-30 14:56:23 -04:00
4cc47349a5
undf: assign 847-849; stamp freecad/retroarch patches
2026-03-30 14:53:28 -04:00
0d852be0a3
undf: assign 845-846; stamp firefox patches
2026-03-30 14:51:42 -04:00
558f0d30c2
undf: stamp clementine patches (UNDF-2026-000000841..842)
2026-03-30 14:43:28 -04:00
fb2c48dc37
undf: stamp kdenlive-0005..0008 (UNDF-2026-000000835..838)
2026-03-30 14:40:29 -04:00
9bdea940fc
undf: assign 828-832; stamp patches; tomcat-0001/hibernate-orm-0001/netty-0001/netty-0002
2026-03-30 13:55:42 -04:00
7f2c2a1a36
undf: assign UNDF-2026-000000823; stamp terraform-0001/ansible-0002/ansible-0003
2026-03-30 13:29:54 -04:00
3d2957276d
undf: assign UNDF-2026-000000822; stamp telegraf-0001 patch
2026-03-30 13:28:35 -04:00
2ccaf9e7fa
undf: assign UNDF-2026-000000821; stamp loki-0001 patch
2026-03-30 13:18:59 -04:00
cf2c734de1
undf: assign UNDF-2026-000000819 through 000000820; rename hive-0004/hive-0005; stamp patches
2026-03-30 13:17:14 -04:00
4f51d81913
undf: assign UNDF-2026-000000815 through 000000817; stamp superset patches
2026-03-30 13:04:50 -04:00
9b3008a2b1
undf: assign UNDF-2026-000000813; stamp neovim-0001 patch
2026-03-30 11:46:05 -04:00
ae2eaf3be9
undf: assign UNDF-2026-000000807 through 000000812; stamp vscode+zed patches
2026-03-30 11:43:50 -04:00
f8eb370fe4
undf: assign 806; stamp vlc+obs-studio patches
2026-03-30 11:33:21 -04:00
20f60ee078
undf: assign 798-805; stamp kdenlive+shotcut patches
2026-03-30 11:28:35 -04:00
20089cbd72
undf: assign 793-794; stamp gimp patches
2026-03-30 11:22:14 -04:00
b5c2a3d989
undf: stamp patches, update registry to 792
2026-03-30 11:15:59 -04:00
9b71d0d527
undf: assign 778-785; stamp inkscape/blender patches
2026-03-30 11:13:27 -04:00
a0dde8b41a
undf: assign 775-776; stamp deluge patches
2026-03-30 10:37:20 -04:00
c967910a44
undf: assign UNDF-2026-000000774; stamp llvm-0006 patch
2026-03-30 10:34:45 -04:00
36595d65fb
undf: stamp rustc/swift patches, update registry to 773
2026-03-30 10:27:44 -04:00
79a77db4f8
undf: assign 768-770; stamp minio patches
2026-03-30 10:25:20 -04:00
e45af3961b
undf: stamp duckdb/arrow patches; update registry to 767
2026-03-30 10:12:10 -04:00
0772cf539a
undf: assign UNDF-2026-000000761..762, 000000301; stamp flink-0006/0007/storm-0001 patches
2026-03-30 09:53:25 -04:00
