VulnVault
Home SAST Secrets IaC License Container Secrets Container Best SAMM SCM

SAST Security Overview

Generated: 2026-01-30 11:57:17

Total Controls

1742

Active Controls

1742

Disabled

0

High Priority

431

Key Insights

  • 1742 active controls (100.0%).
  • Medium priority leads with 680 findings (57.9%).
  • Top category: Source code vulnerabilities · 650 controls.
  • Most affected language: javascript · 243 findings.
  • Most mapped OWASP: OWASP: A03:2021 · 291 references.
  • Most referenced CWE: CWE-327 · 116 instances.

Top Categories

Source code vulnerabilities650
Best practices264
Data protection182
Authentication30
Access control25
Network misconfigurations7
AI/LLM Security5
Workload misconfigurations3

Top Languages

javascript243
python237
java200
golang99
typescript91
scala74
kotlin64
c58

Priority Distribution

MEDIUM680
HIGH431
INFO63

OWASP Top Mappings

OWASPCountPercentage
OWASP: A03:202129120.9%
OWASP: A01:201721515.4%
OWASP: A03:201721015.1%
OWASP: A02:202117812.8%
OWASP: A01:2021977.0%
OWASP: A05:2021624.4%
OWASP: A05:2017614.4%
OWASP: A07:2017433.1%
OWASP: A06:2017382.7%
OWASP: A08:2021342.4%
OWASP: A07:2021322.3%
OWASP: A08:2017292.1%
OWASP: A04:2017261.9%
OWASP: A02:2017231.6%
OWASP: A04:2021231.6%
OWASP: A10:2021171.2%
OWASP: A09:201750.4%
OWASP: A06:202140.3%
OWASP: LLM05:202520.1%
OWASP: A09:202120.1%
OWASP: LLM06:202510.1%
OWASP: LLM01:202510.1%
OWASP: LLM02:202510.1%

Critical & High Priority Issues (Top 20)

IDTitlePriorityCategoryCWEExamples
00c0f304-2d21-5fee-b2ad-4346f0a156a5Potential Server-Side Request Forgery via Unverified User DataHIGHSource code vulnerabilitiesCWE-918
010cf80b-f91d-57fc-8ee4-de27bee5e851SQL Injection via Untrusted Input in Raw SQL QueriesHIGHSource code vulnerabilitiesCWE-89
01677bd8-6483-5a60-9dce-72269e1a6108Improper Use of HTTP Request Context in GoroutinesHIGHBest practicesN/A
01dcf76d-f327-5d9a-be85-9b58d3a3bbeaPotential command injection due to executing non-constant commandsHIGHSource code vulnerabilitiesCWE-94
0231ff96-1439-5b16-9025-edbedfa8ee94Prevent Unverified User Data from Reaching VM in Express ApplicationsHIGHSource code vulnerabilitiesCWE-94
02e6cee9-74e8-5306-b5f0-61a56a14f653Missing final call on Decipher object compromises encryption integrityHIGHSource code vulnerabilitiesCWE-310
03b5ad42-e76e-5fe7-bf68-8232be8d9037Global CSRF Check Disabled in Pyramid FrameworkHIGHAuthenticationCWE-352
040f6cda-d0db-5e53-b97e-a32fe10272cdUnverified SSL Context Allows Insecure ConnectionsHIGHBest practicesCWE-295
0424a0c3-b1e6-52bd-9b74-8a481ed51f5cPotential Arbitrary Code Execution via TensorFlow Load FunctionHIGHSource code vulnerabilitiesCWE-502
0479a3de-3f26-5a99-b237-bcd8cbce1b64User Input Directly Used in SQL String ConstructionHIGHSource code vulnerabilitiesCWE-704
047b2e8f-55e4-57be-90cb-821e819100dePotential privilege escalation due to unchecked function return valuesHIGHAccess controlCWE-250
048a21e4-6d31-5b94-b797-24e97f8bca8cDisabling Strict Contextual Escaping (SCE) in AngularJS Increases XSS RiskHIGHSource code vulnerabilitiesCWE-79
048cc13b-0a99-57fd-af55-589ef11c2ad3Reflected Cross-Site Scripting Vulnerability from Untrusted InputHIGHSource code vulnerabilitiesCWE-79
052f30db-ed3e-55fd-8ec7-a4556d26f566Potential SQL Injection Risk from Formatted SQL StringsHIGHSource code vulnerabilitiesCWE-89
0581fb56-a699-514b-8c76-1307051e6b6cPotential Command Injection via User Controlled Subprocess ArgumentsHIGHSource code vulnerabilitiesCWE-78
091d0833-d4d9-5de0-a21c-ab9bf53d6504Insecure SSL Connection: Server Identity Verification DisabledHIGHBest practicesCWE-297
0ae5675e-fa24-5efb-aa5b-6df5a784f92fCBC with PKCS5Padding is vulnerable to padding oracle attacksHIGHSource code vulnerabilitiesCWE-327
0afdcc14-8309-57ea-b574-397cb0a15a59Sequelize Connection String Uses Deprecated TLS VersionHIGHBest practicesCWE-757
0b3b2dc2-bc41-5544-b6ac-7a999536d6d7Potential SQL Injection via Untrusted Input in Raw SQL QueriesHIGHSource code vulnerabilitiesCWE-89
0c5f86a3-2c2d-5472-b6da-6820465295d3Apollo GraphQL Server Lacks CSRF Prevention OptionHIGHBest practicesCWE-352

All Security Issues

ID Title Impact Category Confidence OWASP