@zerothreatai/vulnerability-registry 3.0.0 → 4.0.0

package/src/categories/configuration.ts

@@ -17,6 +17,7 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         title: 'Missing Security Header - Content-Security-Policy',
         description: 'The application does not implement Content-Security-Policy header, leaving it vulnerable to cross-site scripting attacks that could be mitigated by restricting the sources from which scripts, styles, and other resources can be loaded into the page.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -33,12 +34,13 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         remediation: 'Implement Content-Security-Policy header with strict directives. Start with default-src self and progressively add required sources. Use nonce-based CSP for inline scripts.',
     },
 
-    [VulnerabilityCode.HEADER_MISSING_HSTS]: {
-        id: 70,
-        code: VulnerabilityCode.HEADER_MISSING_HSTS,
-        title: 'Missing Security Header - Strict-Transport-Security',
+    [VulnerabilityCode.HEADER_MISSING_HSTS]: {
+        id: 70,
+        code: VulnerabilityCode.HEADER_MISSING_HSTS,
+        title: 'Missing Security Header - Strict-Transport-Security',
         description: 'The application does not implement HSTS (HTTP Strict Transport Security) header, leaving users vulnerable to SSL stripping attacks and man-in-the-middle downgrades from HTTPS to HTTP connections on initial visits or after cookie expiration.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -52,96 +54,100 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Add Strict-Transport-Security header with max-age of at least 31536000 (1 year). Include includeSubDomains directive. Consider HSTS preloading for maximum protection.',
-    },
-
-    [VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE]: {
-        id: 1011,
-        code: VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE,
-        title: 'HSTS Misconfiguration - Invalid Max-Age',
-        description: 'The Strict-Transport-Security header uses an invalid or malformed max-age value, preventing reliable HTTPS enforcement.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set a valid numeric max-age on Strict-Transport-Security (at least 31536000).',
-    },
-
-    [VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE]: {
-        id: 1012,
-        code: VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE,
-        title: 'HSTS Misconfiguration - Max-Age Too Short',
-        description: 'The Strict-Transport-Security header uses a short max-age value that weakens HTTPS enforcement and allows downgrade risk to return quickly.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Increase max-age to at least 31536000 (1 year) to provide durable HTTPS enforcement.',
-    },
-
-    [VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS]: {
-        id: 1013,
-        code: VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS,
-        title: 'HSTS Misconfiguration - Missing includeSubDomains',
-        description: 'The Strict-Transport-Security header is missing includeSubDomains, leaving subdomains unprotected from downgrade and stripping attacks.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Add includeSubDomains to the HSTS header to protect all subdomains.',
-    },
-
-    [VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE]: {
-        id: 1018,
-        code: VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE,
-        title: 'HSTS Preload Requirements Not Met',
-        description: 'The HSTS header indicates preload intent but does not meet preload requirements, such as a sufficiently long max-age or includeSubDomains, reducing preload effectiveness.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Ensure HSTS max-age is at least 31536000, include includeSubDomains, and add preload before submitting to the preload list.',
-    },
+        remediation: 'Add Strict-Transport-Security header with max-age of at least 31536000 (1 year). Include includeSubDomains directive. Consider HSTS preloading for maximum protection.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE]: {
+        id: 1011,
+        code: VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE,
+        title: 'HSTS Misconfiguration - Invalid Max-Age',
+        description: 'The Strict-Transport-Security header uses an invalid or malformed max-age value, preventing reliable HTTPS enforcement.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set a valid numeric max-age on Strict-Transport-Security (at least 31536000).',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE]: {
+        id: 1012,
+        code: VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE,
+        title: 'HSTS Misconfiguration - Max-Age Too Short',
+        description: 'The Strict-Transport-Security header uses a short max-age value that weakens HTTPS enforcement and allows downgrade risk to return quickly.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Increase max-age to at least 31536000 (1 year) to provide durable HTTPS enforcement.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS]: {
+        id: 1013,
+        code: VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS,
+        title: 'HSTS Misconfiguration - Missing includeSubDomains',
+        description: 'The Strict-Transport-Security header is missing includeSubDomains, leaving subdomains unprotected from downgrade and stripping attacks.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add includeSubDomains to the HSTS header to protect all subdomains.',
+    },
+
+    [VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE]: {
+        id: 1018,
+        code: VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE,
+        title: 'HSTS Preload Requirements Not Met',
+        description: 'The HSTS header indicates preload intent but does not meet preload requirements, such as a sufficiently long max-age or includeSubDomains, reducing preload effectiveness.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-319', name: 'Cleartext Transmission', url: 'https://cwe.mitre.org/data/definitions/319.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Ensure HSTS max-age is at least 31536000, include includeSubDomains, and add preload before submitting to the preload list.',
+    },
 
     [VulnerabilityCode.HEADER_MISSING_XFRAME]: {
         id: 71,
@@ -149,570 +155,1632 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         title: 'Missing Security Header - X-Frame-Options',
         description: 'The application does not set X-Frame-Options header, making it vulnerable to clickjacking attacks where malicious websites can embed the application in invisible iframes and trick users into performing unintended actions through deceptive UI overlays.',
         severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 4.7,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set X-Frame-Options header to DENY or SAMEORIGIN. Use Content-Security-Policy frame-ancestors directive for more granular control. Both headers can be used together for compatibility.',
+    },
+
+    [VulnerabilityCode.HEADER_WEAK_CSP]: {
+        id: 72,
+        code: VulnerabilityCode.HEADER_WEAK_CSP,
+        title: 'Weak Content-Security-Policy Configuration',
+        description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove unsafe-inline and unsafe-eval directives. Use nonce-based or hash-based CSP for inline scripts. Restrict source allowlists to specific trusted domains rather than wildcards.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_REPORT_ONLY]: {
+        id: 1001,
+        code: VulnerabilityCode.HEADER_CSP_REPORT_ONLY,
+        title: 'Content-Security-Policy Report-Only Enabled',
+        description: 'The Content-Security-Policy header is deployed in report-only mode, which does not enforce protections and allows unsafe content to execute while only logging violations.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Switch to enforcing Content-Security-Policy once violations are reviewed. Use report-only during rollout, then enforce with strict directives.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES]: {
+        id: 1002,
+        code: VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES,
+        title: 'Content-Security-Policy Contains Unsafe Directives',
+        description: 'The Content-Security-Policy header includes unsafe directives such as unsafe-inline or unsafe-eval that reduce XSS protection and allow risky script execution paths.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove unsafe-inline and unsafe-eval directives. Replace inline scripts with nonces or hashes and restrict sources to trusted domains.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT]: {
+        id: 1003,
+        code: VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT,
+        title: 'Content-Security-Policy Allows data: in script-src',
+        description: 'The CSP allows data: URIs for script execution, which can enable script injection through crafted data URLs and weaken XSS protections.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove data: from script-src. Use nonce or hash-based CSP for any required inline scripts.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT]: {
+        id: 1004,
+        code: VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT,
+        title: 'Content-Security-Policy Allows blob: in script-src',
+        description: 'The CSP allows blob: URIs for script execution, which can be abused to load attacker-controlled scripts in some contexts and weaken XSS mitigations.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove blob: from script-src unless strictly required. Use a narrower allowlist or nonces for trusted scripts.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT]: {
+        id: 1005,
+        code: VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT,
+        title: 'Content-Security-Policy default-src Uses Wildcard',
+        description: 'The CSP default-src directive allows all origins, which effectively disables the protection and allows untrusted content to load.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Replace wildcard default-src with explicit trusted origins and tighten resource-specific directives.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_BASE_URI]: {
+        id: 1006,
+        code: VulnerabilityCode.HEADER_CSP_NO_BASE_URI,
+        title: 'Content-Security-Policy Missing base-uri Directive',
+        description: 'The CSP does not include a base-uri directive, allowing the base URL to be set by injected markup and enabling abuse of relative URL resolution.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add base-uri \'self\' (or a strict allowlist) to CSP to prevent base tag abuse.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC]: {
+        id: 1007,
+        code: VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC,
+        title: 'Content-Security-Policy Missing object-src Directive',
+        description: 'The CSP does not include an object-src directive, allowing embedded objects to load from arbitrary origins and weakening defense-in-depth against plugin-based risks.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add object-src \'none\' (or a strict allowlist) to CSP to prevent plugin content loading.',
+    },
+
+    [VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS]: {
+        id: 1008,
+        code: VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS,
+        title: 'Content-Security-Policy Missing frame-ancestors Directive',
+        description: 'The CSP does not include a frame-ancestors directive, leaving pages potentially frameable and vulnerable to clickjacking attacks.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 4.7,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add frame-ancestors \'none\' or a strict allowlist to CSP to prevent clickjacking.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_MISCONFIGURED]: {
+        id: 73,
+        code: VulnerabilityCode.HEADER_CORS_MISCONFIGURED,
+        title: 'CORS Misconfiguration',
+        description: 'Cross-Origin Resource Sharing is misconfigured with overly permissive Access-Control-Allow-Origin headers including wildcard (*) with credentials, or dynamic reflection of Origin header without proper validation, enabling cross-origin data theft.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Implement strict Origin validation with allowlist of trusted domains. Never reflect Origin header without validation. Do not use wildcard with Access-Control-Allow-Credentials.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS]: {
+        id: 1014,
+        code: VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS,
+        title: 'CORS Wildcard With Credentials',
+        description: 'Access-Control-Allow-Origin is set to * while Access-Control-Allow-Credentials is enabled, which browsers block but signals a dangerous CORS policy that can be misapplied in some environments.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Never use wildcard origins with credentials. Replace * with an explicit allowlist and set Vary: Origin.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY]: {
+        id: 1015,
+        code: VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY,
+        title: 'CORS Origin Reflection Without Vary',
+        description: 'The Origin header is reflected in Access-Control-Allow-Origin without Vary: Origin, which can lead to cache poisoning and unintended cross-origin access.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Validate origins against an allowlist and always include Vary: Origin when dynamically setting Access-Control-Allow-Origin.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_NULL_ORIGIN]: {
+        id: 1016,
+        code: VulnerabilityCode.HEADER_CORS_NULL_ORIGIN,
+        title: 'CORS Allows Null Origin',
+        description: 'Access-Control-Allow-Origin allows the null origin, enabling requests from opaque origins such as sandboxed iframes and file URLs that can be abused to access sensitive data.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove null from allowed origins. Restrict CORS to explicit trusted domains only.',
+    },
+
+    [VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN]: {
+        id: 1017,
+        code: VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN,
+        title: 'CORS Allows Wildcard Subdomains',
+        description: 'CORS policies allow wildcard subdomains that can be abused if any subdomain is compromised or can be controlled by untrusted parties.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.5,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Replace wildcard subdomains with a strict allowlist of trusted origins.',
+    },
+
+    // ========================================
+    // DIRECTORY BROWSING
+    // ========================================
+    [VulnerabilityCode.DIRBROWSE_GENERIC]: {
+        id: 2000,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC,
+        title: 'Directory Listing Enabled (Generic)',
+        description: 'Directory listing is enabled and exposes directory contents to unauthenticated visitors, revealing application structure and file names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing in the web server configuration and ensure directories have index files.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE]: {
+        id: 2001,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE,
+        title: 'Directory Listing Exposing Sensitive Content (Generic)',
+        description: 'Directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_APACHE]: {
+        id: 2002,
+        code: VulnerabilityCode.DIRBROWSE_APACHE,
+        title: 'Apache Autoindex Enabled',
+        description: 'Apache autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in Apache (Options -Indexes) and add index files.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE]: {
+        id: 2003,
+        code: VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE,
+        title: 'Apache Autoindex Exposing Sensitive Content',
+        description: 'Apache autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_NGINX]: {
+        id: 2004,
+        code: VulnerabilityCode.DIRBROWSE_NGINX,
+        title: 'Nginx Autoindex Enabled',
+        description: 'Nginx autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in nginx (autoindex off) and add index files.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE]: {
+        id: 2005,
+        code: VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE,
+        title: 'Nginx Autoindex Exposing Sensitive Content',
+        description: 'Nginx autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_IIS]: {
+        id: 2006,
+        code: VulnerabilityCode.DIRBROWSE_IIS,
+        title: 'IIS Directory Browsing Enabled',
+        description: 'IIS directory browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing in IIS and ensure directories have index files.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE]: {
+        id: 2007,
+        code: VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE,
+        title: 'IIS Directory Browsing Exposing Sensitive Content',
+        description: 'IIS directory browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_TOMCAT]: {
+        id: 2008,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT,
+        title: 'Tomcat Directory Listing Enabled',
+        description: 'Tomcat directory listing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings in Tomcat and add index files to web directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE]: {
+        id: 2009,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE,
+        title: 'Tomcat Directory Listing Exposing Sensitive Content',
+        description: 'Tomcat directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_CADDY]: {
+        id: 2010,
+        code: VulnerabilityCode.DIRBROWSE_CADDY,
+        title: 'Caddy File Server Browsing Enabled',
+        description: 'Caddy file server browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse in Caddy or restrict browsing to trusted users.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE]: {
+        id: 2011,
+        code: VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE,
+        title: 'Caddy File Server Browsing Exposing Sensitive Content',
+        description: 'Caddy file server browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse and remove sensitive files from web-accessible directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_WEBDAV]: {
+        id: 2012,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV,
+        title: 'WebDAV Directory Listing Enabled',
+        description: 'WebDAV responses expose directory contents, allowing unauthenticated browsing of files and folders.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing or restrict access with authentication and authorization.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE]: {
+        id: 2013,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE,
+        title: 'WebDAV Directory Listing Exposing Sensitive Content',
+        description: 'WebDAV responses expose directories containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing and remove sensitive files from exposed directories.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_S3]: {
+        id: 2014,
+        code: VulnerabilityCode.DIRBROWSE_S3,
+        title: 'S3 Bucket Listing Enabled',
+        description: 'An S3 bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public ListBucket access and restrict bucket policies to authorized principals.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_S3_SENSITIVE]: {
+        id: 2015,
+        code: VulnerabilityCode.DIRBROWSE_S3_SENSITIVE,
+        title: 'S3 Bucket Listing Exposing Sensitive Content',
+        description: 'An S3 bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public ListBucket access and rotate any exposed credentials or secrets.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_GCS]: {
+        id: 2016,
+        code: VulnerabilityCode.DIRBROWSE_GCS,
+        title: 'GCS Bucket Listing Enabled',
+        description: 'A Google Cloud Storage bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Restrict bucket IAM policies to authorized principals and disable anonymous listing.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE]: {
+        id: 2017,
+        code: VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE,
+        title: 'GCS Bucket Listing Exposing Sensitive Content',
+        description: 'A Google Cloud Storage bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB]: {
+        id: 2018,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB,
+        title: 'Azure Blob Container Listing Enabled',
+        description: 'An Azure Blob container listing is exposed, allowing unauthenticated enumeration of blob names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public container listing and restrict access via SAS tokens or RBAC.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE]: {
+        id: 2019,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE,
+        title: 'Azure Blob Container Listing Exposing Sensitive Content',
+        description: 'An Azure Blob container listing is exposed and includes sensitive blobs such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+
+    // Legacy generic codes (keep for backward compatibility)
+    [VulnerabilityCode.DIRBROWSE_ENABLED]: {
+        id: 74,
+        code: VulnerabilityCode.DIRBROWSE_ENABLED,
+        title: 'Directory Listing Enabled',
+        description: 'Web server directory listing is enabled, exposing the contents of directories to anyone who browses to them without an index file. This reveals application structure, backup files, configuration files, and potentially sensitive data to attackers.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing in web server configuration (Options -Indexes in Apache, autoindex off in nginx). Ensure all directories have proper index files.',
+    },
+
+    [VulnerabilityCode.DIRBROWSE_SENSITIVE]: {
+        id: 75,
+        code: VulnerabilityCode.DIRBROWSE_SENSITIVE,
+        title: 'Directory Listing Exposing Sensitive Content',
+        description: 'Directory listing is enabled on a directory containing sensitive files like backups, configuration files, source code, or credentials. This elevates the risk significantly as attackers can directly access sensitive information without guessing filenames.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Immediately disable directory listing. Remove sensitive files from web-accessible directories. Implement proper access controls. Audit exposed content for credentials or sensitive data.',
+    },
+
+    // ========================================
+    // CLICKJACKING
+    // ========================================
+    [VulnerabilityCode.CLICK_FRAMEABLE]: {
+        id: 76,
+        code: VulnerabilityCode.CLICK_FRAMEABLE,
+        title: 'Clickjacking - Page Frameable',
+        description: 'The application pages can be embedded in iframes on malicious websites, enabling clickjacking attacks where attackers overlay transparent frames over deceptive UI elements to trick users into clicking hidden buttons or links that perform unintended actions.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 4.7,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Implement X-Frame-Options header with DENY or SAMEORIGIN value. Use Content-Security-Policy frame-ancestors directive. Add JavaScript frame-busting code as defense in depth.',
+    },
+
+    // ========================================
+    // DESERIALIZATION
+    // ========================================
+    [VulnerabilityCode.DESER_JAVA]: {
+        id: 77,
+        code: VulnerabilityCode.DESER_JAVA,
+        title: 'Insecure Deserialization - Java',
+        description: 'Critical Java deserialization vulnerability where untrusted serialized objects are processed, allowing attackers to achieve remote code execution through gadget chains in common libraries like Apache Commons Collections, Spring Framework, or other classpath dependencies.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Do not deserialize untrusted data. Use JSON or XML instead of Java serialization. Implement ObjectInputFilter (JEP 290) to restrict deserializable classes. Remove vulnerable gadget libraries.',
+    },
+
+    [VulnerabilityCode.DESER_PHP]: {
+        id: 78,
+        code: VulnerabilityCode.DESER_PHP,
+        title: 'Insecure Deserialization - PHP',
+        description: 'Critical PHP deserialization vulnerability where unserialize() processes attacker-controlled data, enabling object injection attacks through magic methods like __wakeup(), __destruct(), or __toString() in application or framework classes for remote code execution.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Never pass user input to unserialize(). Use json_decode() instead. If serialization is required, use allowed_classes option with explicit allowlist. Audit code for pop chains.',
+    },
+
+    [VulnerabilityCode.DESER_PYTHON]: {
+        id: 79,
+        code: VulnerabilityCode.DESER_PYTHON,
+        title: 'Insecure Deserialization - Python',
+        description: 'Critical Python deserialization vulnerability through pickle/cPickle processing of untrusted data, enabling remote code execution via __reduce__ method exploitation. Python pickle is inherently unsafe and should never process untrusted input.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Never pickle untrusted data. Use JSON or other safe formats. If pickle is required, use cryptographic signatures to verify data integrity before deserialization.',
+    },
+
+    [VulnerabilityCode.DESER_DOTNET]: {
+        id: 80,
+        code: VulnerabilityCode.DESER_DOTNET,
+        title: 'Insecure Deserialization - .NET',
+        description: 'Critical .NET deserialization vulnerability through BinaryFormatter, ObjectStateFormatter, LosFormatter, or other dangerous formatters processing untrusted data, enabling remote code execution through gadget chains in the .NET runtime or third-party libraries.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Avoid BinaryFormatter for untrusted data. Use System.Text.Json or XmlSerializer with known types. For legacy code, implement SerializationBinder to restrict deserializable types.',
+    },
+
+    [VulnerabilityCode.DESER_RUBY]: {
+        id: 81,
+        code: VulnerabilityCode.DESER_RUBY,
+        title: 'Insecure Deserialization - Ruby',
+        description: 'Critical Ruby deserialization vulnerability through Marshal.load or YAML.load processing untrusted data, enabling remote code execution through Ruby object instantiation gadgets that execute arbitrary code during object reconstruction.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Never Marshal.load untrusted data. Use JSON.parse instead. For YAML, use YAML.safe_load with permitted_classes option. Sign serialized data with HMAC for integrity.',
+    },
+
+    [VulnerabilityCode.DESER_NODE]: {
+        id: 82,
+        code: VulnerabilityCode.DESER_NODE,
+        title: 'Insecure Deserialization - Node.js',
+        description: 'Critical Node.js deserialization vulnerability through node-serialize, funcster, or similar libraries that execute JavaScript during deserialization, enabling remote code execution when attacker-controlled serialized data containing functions or IIFE is processed.',
+        severity: 'critical',
+        levelId: 1,
+        category: 'injection',
+        scanner: 'deserialization',
+        cvss: {
+            score: 9.8,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+            severity: 'CRITICAL',
+        },
+        cwe: [
+            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+        ],
+        owasp: [
+            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+        ],
+        remediation: 'Never use serialization libraries that can deserialize functions. Use JSON.parse() for data interchange. Avoid node-serialize and similar libraries. Implement input validation.',
+    },
+
+    [VulnerabilityCode.CLICK_PARTIAL_PROTECTION]: {
+        id: 83,
+        code: VulnerabilityCode.CLICK_PARTIAL_PROTECTION,
+        title: 'Clickjacking - Partial Protection',
+        description: 'Incomplete clickjacking protection where X-Frame-Options or frame-ancestors CSP is only applied on some pages, uses weak values like ALLOW-FROM with bypassable origins, or has inconsistent implementation allowing certain pages to be framed.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Apply consistent frame protection across all pages. Use DENY or SAMEORIGIN rather than ALLOW-FROM. Audit all endpoints for missing protection. Use CSP frame-ancestors instead of X-Frame-Options.',
+    },
+
+    [VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE]: {
+        id: 84,
+        code: VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE,
+        title: 'Missing Security Header - X-Content-Type-Options',
+        description: 'The application does not set X-Content-Type-Options: nosniff header, allowing browsers to perform MIME-type sniffing that can lead to XSS attacks when user-uploaded content is served with incorrect Content-Type and browsers execute it as script.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add X-Content-Type-Options: nosniff header to all responses. Ensure correct Content-Type headers are set for all resources. Validate file types before serving user uploads.',
+    },
+
+    [VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID]: {
+        id: 1009,
+        code: VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID,
+        title: 'Invalid Security Header - X-Content-Type-Options',
+        description: 'The X-Content-Type-Options header is present but misconfigured (not set to nosniff), which can allow MIME sniffing and reduce protection against content-type confusion.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set X-Content-Type-Options to nosniff on all responses to prevent MIME sniffing.',
+    },
+
+    [VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY]: {
+        id: 85,
+        code: VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY,
+        title: 'Missing Security Header - Referrer-Policy',
+        description: 'The application does not implement Referrer-Policy header, potentially leaking sensitive URL information including session tokens, user IDs, or query parameters to external sites when users click links or resources are loaded from third-party domains.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Implement Referrer-Policy header with strict-origin-when-cross-origin or no-referrer policy. Avoid passing sensitive data in URLs. Use POST requests for sensitive operations.',
+    },
+
+    [VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE]: {
+        id: 1010,
+        code: VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE,
+        title: 'Unsafe Referrer-Policy Configuration',
+        description: 'The Referrer-Policy header is set to a permissive value that can leak full URLs and sensitive query parameters to external origins.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Use strict-origin-when-cross-origin or no-referrer to minimize leakage of sensitive URL data.',
+    },
+
+    [VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY]: {
+        id: 86,
+        code: VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY,
+        title: 'Missing Security Header - Permissions-Policy',
+        description: 'The application does not implement Permissions-Policy (formerly Feature-Policy) header, allowing embedded frames or malicious scripts to access sensitive browser features like camera, microphone, geolocation, or payment APIs without explicit permission.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 2.0,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Add Permissions-Policy header restricting access to sensitive features. Disable features not needed by the application. Use () syntax to disallow features for all origins.',
+    },
+
+    [VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION]: {
+        id: 87,
+        code: VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION,
+        title: 'Missing Security Header - X-XSS-Protection',
+        description: 'The legacy X-XSS-Protection header is not set. While deprecated in modern browsers, it can provide defense-in-depth for older browsers that still honor this header for their built-in XSS auditor feature.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 0.0,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N',
+            severity: 'NONE',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set X-XSS-Protection: 0 to disable (recommended per OWASP) or use CSP instead. The XSS auditor has been removed from modern browsers due to security issues with block mode.',
+    },
+
+    [VulnerabilityCode.HEADER_COEP_WITHOUT_COOP]: {
+        id: 108,
+        code: VulnerabilityCode.HEADER_COEP_WITHOUT_COOP,
+        title: 'Header Misconfiguration - COEP Without COOP',
+        description: 'Cross-Origin-Embedder-Policy (COEP) is set without Cross-Origin-Opener-Policy (COOP), which can create inconsistent cross-origin isolation behavior and indicate incomplete or misapplied security header strategy for isolation-sensitive applications.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 2.0,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'If cross-origin isolation is required, deploy COEP together with COOP and validate the intended policy combination. Otherwise remove COEP to avoid confusing or inconsistent isolation posture.',
+    },
+
+    [VulnerabilityCode.HEADER_CORP_UNUSUAL]: {
+        id: 109,
+        code: VulnerabilityCode.HEADER_CORP_UNUSUAL,
+        title: 'Header Misconfiguration - Unusual CORP Value',
+        description: 'Cross-Origin-Resource-Policy (CORP) is set to a non-standard value, which may indicate a misconfiguration that provides no effective protection or creates unpredictable resource loading behavior across origins.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 2.0,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Use valid CORP values (same-origin, same-site, or cross-origin) and confirm the chosen policy aligns with the resource sharing model of the application.',
+    },
+
+    [VulnerabilityCode.HEADER_EXPECT_CT_PRESENT]: {
+        id: 110,
+        code: VulnerabilityCode.HEADER_EXPECT_CT_PRESENT,
+        title: 'Deprecated Header - Expect-CT Present',
+        description: 'The Expect-CT header is present even though the feature is deprecated and no longer enforced by major browsers, adding unnecessary configuration surface without meaningful security benefit.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 0.0,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N',
+            severity: 'NONE',
+        },
+        cwe: [
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove Expect-CT unless you have a legacy operational requirement, and focus on TLS configuration and certificate transparency monitoring via modern tooling.',
+    },
+
+    [VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT]: {
+        id: 111,
+        code: VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT,
+        title: 'Information Exposure - Server Header Present',
+        description: 'The Server header reveals technology or version details that can assist attackers with fingerprinting and targeted exploitation, increasing the likelihood of tailored attacks against known software weaknesses.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Configure the web server or reverse proxy to minimize or remove Server header details and avoid exposing version strings in responses.',
+    },
+
+    [VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT]: {
+        id: 112,
+        code: VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT,
+        title: 'Information Exposure - X-Powered-By Present',
+        description: 'The X-Powered-By header discloses framework or runtime information that can be used to fingerprint the application stack and target known vulnerabilities in specific platforms or versions.',
+        severity: 'info',
+        levelId: 5,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable X-Powered-By headers in application frameworks or reverse proxies to reduce stack fingerprinting exposure.',
+    },
+
+    [VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED]: {
+        id: 113,
+        code: VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED,
+        title: 'Deprecated Header - X-XSS-Protection Enabled',
+        description: 'The X-XSS-Protection header is enabled, which is deprecated and can introduce security risks or inconsistent behavior in legacy browsers due to the removed XSS auditor feature.',
+        severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 4.7,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
-            severity: 'MEDIUM',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Set X-Frame-Options header to DENY or SAMEORIGIN. Use Content-Security-Policy frame-ancestors directive for more granular control. Both headers can be used together for compatibility.',
+        remediation: 'Prefer modern CSP protections and set X-XSS-Protection: 0 or remove the header to avoid relying on deprecated behavior.',
     },
 
-    [VulnerabilityCode.HEADER_WEAK_CSP]: {
-        id: 72,
-        code: VulnerabilityCode.HEADER_WEAK_CSP,
-        title: 'Weak Content-Security-Policy Configuration',
-        description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
+    [VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE]: {
+        id: 114,
+        code: VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE,
+        title: 'Cookie Misconfiguration - SameSite=None Without Secure',
+        description: 'A cookie is configured with SameSite=None but lacks the Secure attribute, enabling cross-site transmission over unencrypted connections and undermining cookie integrity and confidentiality controls.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
             score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
             severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
+            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Remove unsafe-inline and unsafe-eval directives. Use nonce-based or hash-based CSP for inline scripts. Restrict source allowlists to specific trusted domains rather than wildcards.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_REPORT_ONLY]: {
-        id: 1001,
-        code: VulnerabilityCode.HEADER_CSP_REPORT_ONLY,
-        title: 'Content-Security-Policy Report-Only Enabled',
-        description: 'The Content-Security-Policy header is deployed in report-only mode, which does not enforce protections and allows unsafe content to execute while only logging violations.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Switch to enforcing Content-Security-Policy once violations are reviewed. Use report-only during rollout, then enforce with strict directives.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES]: {
-        id: 1002,
-        code: VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES,
-        title: 'Content-Security-Policy Contains Unsafe Directives',
-        description: 'The Content-Security-Policy header includes unsafe directives such as unsafe-inline or unsafe-eval that reduce XSS protection and allow risky script execution paths.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Remove unsafe-inline and unsafe-eval directives. Replace inline scripts with nonces or hashes and restrict sources to trusted domains.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT]: {
-        id: 1003,
-        code: VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT,
-        title: 'Content-Security-Policy Allows data: in script-src',
-        description: 'The CSP allows data: URIs for script execution, which can enable script injection through crafted data URLs and weaken XSS protections.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Remove data: from script-src. Use nonce or hash-based CSP for any required inline scripts.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT]: {
-        id: 1004,
-        code: VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT,
-        title: 'Content-Security-Policy Allows blob: in script-src',
-        description: 'The CSP allows blob: URIs for script execution, which can be abused to load attacker-controlled scripts in some contexts and weaken XSS mitigations.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Remove blob: from script-src unless strictly required. Use a narrower allowlist or nonces for trusted scripts.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT]: {
-        id: 1005,
-        code: VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT,
-        title: 'Content-Security-Policy default-src Uses Wildcard',
-        description: 'The CSP default-src directive allows all origins, which effectively disables the protection and allows untrusted content to load.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Replace wildcard default-src with explicit trusted origins and tighten resource-specific directives.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_NO_BASE_URI]: {
-        id: 1006,
-        code: VulnerabilityCode.HEADER_CSP_NO_BASE_URI,
-        title: 'Content-Security-Policy Missing base-uri Directive',
-        description: 'The CSP does not include a base-uri directive, allowing the base URL to be set by injected markup and enabling abuse of relative URL resolution.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Add base-uri \'self\' (or a strict allowlist) to CSP to prevent base tag abuse.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC]: {
-        id: 1007,
-        code: VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC,
-        title: 'Content-Security-Policy Missing object-src Directive',
-        description: 'The CSP does not include an object-src directive, allowing embedded objects to load from arbitrary origins and weakening defense-in-depth against plugin-based risks.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Add object-src \'none\' (or a strict allowlist) to CSP to prevent plugin content loading.',
-    },
-
-    [VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS]: {
-        id: 1008,
-        code: VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS,
-        title: 'Content-Security-Policy Missing frame-ancestors Directive',
-        description: 'The CSP does not include a frame-ancestors directive, leaving pages potentially frameable and vulnerable to clickjacking attacks.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 4.7,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Add frame-ancestors \'none\' or a strict allowlist to CSP to prevent clickjacking.',
-    },
-
-    [VulnerabilityCode.HEADER_CORS_MISCONFIGURED]: {
-        id: 73,
-        code: VulnerabilityCode.HEADER_CORS_MISCONFIGURED,
-        title: 'CORS Misconfiguration',
-        description: 'Cross-Origin Resource Sharing is misconfigured with overly permissive Access-Control-Allow-Origin headers including wildcard (*) with credentials, or dynamic reflection of Origin header without proper validation, enabling cross-origin data theft.',
+        remediation: 'Set Secure when SameSite=None is used and ensure the application is served exclusively over HTTPS.',
+    },
+
+    [VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE]: {
+        id: 115,
+        code: VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE,
+        title: 'Cookie Misconfiguration - Session Cookie Missing Secure',
+        description: 'Session or authentication cookies are missing the Secure attribute, allowing them to be transmitted over unencrypted connections and increasing the risk of session hijacking or credential theft.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 7.5,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+            score: 7.1,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N',
             severity: 'HIGH',
         },
         cwe: [
-            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
+            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Implement strict Origin validation with allowlist of trusted domains. Never reflect Origin header without validation. Do not use wildcard with Access-Control-Allow-Credentials.',
-    },
-
-    [VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS]: {
-        id: 1014,
-        code: VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS,
-        title: 'CORS Wildcard With Credentials',
-        description: 'Access-Control-Allow-Origin is set to * while Access-Control-Allow-Credentials is enabled, which browsers block but signals a dangerous CORS policy that can be misapplied in some environments.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.5,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Never use wildcard origins with credentials. Replace * with an explicit allowlist and set Vary: Origin.',
-    },
-
-    [VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY]: {
-        id: 1015,
-        code: VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY,
-        title: 'CORS Origin Reflection Without Vary',
-        description: 'The Origin header is reflected in Access-Control-Allow-Origin without Vary: Origin, which can lead to cache poisoning and unintended cross-origin access.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.5,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Validate origins against an allowlist and always include Vary: Origin when dynamically setting Access-Control-Allow-Origin.',
-    },
-
-    [VulnerabilityCode.HEADER_CORS_NULL_ORIGIN]: {
-        id: 1016,
-        code: VulnerabilityCode.HEADER_CORS_NULL_ORIGIN,
-        title: 'CORS Allows Null Origin',
-        description: 'Access-Control-Allow-Origin allows the null origin, enabling requests from opaque origins such as sandboxed iframes and file URLs that can be abused to access sensitive data.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.5,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Remove null from allowed origins. Restrict CORS to explicit trusted domains only.',
-    },
-
-    [VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN]: {
-        id: 1017,
-        code: VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN,
-        title: 'CORS Allows Wildcard Subdomains',
-        description: 'CORS policies allow wildcard subdomains that can be abused if any subdomain is compromised or can be controlled by untrusted parties.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.5,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-942', name: 'Permissive CORS Policy', url: 'https://cwe.mitre.org/data/definitions/942.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Replace wildcard subdomains with a strict allowlist of trusted origins.',
-    },
+        remediation: 'Apply the Secure attribute to all session cookies and enforce HTTPS with HSTS to prevent downgrade to plaintext.',
+    },
 
-    // ========================================
-    // DIRECTORY BROWSING
-    // ========================================
-    [VulnerabilityCode.DIRBROWSE_ENABLED]: {
-        id: 74,
-        code: VulnerabilityCode.DIRBROWSE_ENABLED,
-        title: 'Directory Listing Enabled',
-        description: 'Web server directory listing is enabled, exposing the contents of directories to anyone who browses to them without an index file. This reveals application structure, backup files, configuration files, and potentially sensitive data to attackers.',
-        severity: 'low',
+    [VulnerabilityCode.COOKIE_MISSING_SECURE]: {
+        id: 116,
+        code: VulnerabilityCode.COOKIE_MISSING_SECURE,
+        title: 'Cookie Misconfiguration - Missing Secure Attribute',
+        description: 'Cookies are set without the Secure attribute, permitting transmission over plaintext HTTP and exposing cookie contents to network interception or manipulation.',
+        severity: 'medium',
+        levelId: 3,
         category: 'configuration',
-        scanner: 'directory-browsing',
+        scanner: 'security-headers',
         cvss: {
-            score: 3.7,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'LOW',
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
+            severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Disable directory listing in web server configuration (Options -Indexes in Apache, autoindex off in nginx). Ensure all directories have proper index files.',
+        remediation: 'Set the Secure attribute on cookies that should only be transmitted over HTTPS.',
     },
 
-    [VulnerabilityCode.DIRBROWSE_SENSITIVE]: {
-        id: 75,
-        code: VulnerabilityCode.DIRBROWSE_SENSITIVE,
-        title: 'Directory Listing Exposing Sensitive Content',
-        description: 'Directory listing is enabled on a directory containing sensitive files like backups, configuration files, source code, or credentials. This elevates the risk significantly as attackers can directly access sensitive information without guessing filenames.',
+    [VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY]: {
+        id: 117,
+        code: VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY,
+        title: 'Cookie Misconfiguration - Session Cookie Missing HttpOnly',
+        description: 'Session or authentication cookies are missing the HttpOnly attribute, allowing client-side scripts to access sensitive cookie values and increasing the impact of XSS attacks.',
+        severity: 'high',
+        levelId: 2,
+        category: 'configuration',
+        scanner: 'security-headers',
+        cvss: {
+            score: 7.1,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N',
+            severity: 'HIGH',
+        },
+        cwe: [
+            { id: 'CWE-1004', name: 'Sensitive Cookie Without HttpOnly Flag', url: 'https://cwe.mitre.org/data/definitions/1004.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Set HttpOnly on session cookies to reduce access from client-side scripts and pair with CSP to mitigate XSS risk.',
+    },
+
+    [VulnerabilityCode.COOKIE_MISSING_HTTPONLY]: {
+        id: 118,
+        code: VulnerabilityCode.COOKIE_MISSING_HTTPONLY,
+        title: 'Cookie Misconfiguration - Missing HttpOnly Attribute',
+        description: 'Cookies are missing the HttpOnly attribute, allowing JavaScript access to cookie values and increasing the potential impact of client-side script injection.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
-        scanner: 'directory-browsing',
+        scanner: 'security-headers',
         cvss: {
             score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
             severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+            { id: 'CWE-1004', name: 'Sensitive Cookie Without HttpOnly Flag', url: 'https://cwe.mitre.org/data/definitions/1004.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Immediately disable directory listing. Remove sensitive files from web-accessible directories. Implement proper access controls. Audit exposed content for credentials or sensitive data.',
+        remediation: 'Add HttpOnly to cookies that should not be accessed by JavaScript to reduce the impact of XSS.',
     },
 
-    // ========================================
-    // CLICKJACKING
-    // ========================================
-    [VulnerabilityCode.CLICK_FRAMEABLE]: {
-        id: 76,
-        code: VulnerabilityCode.CLICK_FRAMEABLE,
-        title: 'Clickjacking - Page Frameable',
-        description: 'The application pages can be embedded in iframes on malicious websites, enabling clickjacking attacks where attackers overlay transparent frames over deceptive UI elements to trick users into clicking hidden buttons or links that perform unintended actions.',
+    [VulnerabilityCode.COOKIE_MISSING_SAMESITE]: {
+        id: 119,
+        code: VulnerabilityCode.COOKIE_MISSING_SAMESITE,
+        title: 'Cookie Misconfiguration - Missing SameSite Attribute',
+        description: 'Cookies do not specify SameSite, which can allow cross-site requests to include cookies by default and increase exposure to CSRF-style attacks or cross-site leakage.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 4.7,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N',
+            score: 4.3,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N',
             severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Implement X-Frame-Options header with DENY or SAMEORIGIN value. Use Content-Security-Policy frame-ancestors directive. Add JavaScript frame-busting code as defense in depth.',
+        remediation: 'Set SameSite=Lax for general cookies or SameSite=Strict where appropriate to reduce cross-site cookie inclusion.',
     },
 
-    // ========================================
-    // DESERIALIZATION
-    // ========================================
-    [VulnerabilityCode.DESER_JAVA]: {
-        id: 77,
-        code: VulnerabilityCode.DESER_JAVA,
-        title: 'Insecure Deserialization - Java',
-        description: 'Critical Java deserialization vulnerability where untrusted serialized objects are processed, allowing attackers to achieve remote code execution through gadget chains in common libraries like Apache Commons Collections, Spring Framework, or other classpath dependencies.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID]: {
+        id: 120,
+        code: VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID,
+        title: 'Cookie Misconfiguration - __Host- Prefix Violations',
+        description: 'Cookies with the __Host- prefix do not meet required attributes (Secure, Path=/, no Domain), weakening the protections provided by host-only cookie semantics.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
+            severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Do not deserialize untrusted data. Use JSON or XML instead of Java serialization. Implement ObjectInputFilter (JEP 290) to restrict deserializable classes. Remove vulnerable gadget libraries.',
+        remediation: 'Ensure __Host- cookies include Secure, Path=/, and omit the Domain attribute to preserve host-only guarantees.',
     },
 
-    [VulnerabilityCode.DESER_PHP]: {
-        id: 78,
-        code: VulnerabilityCode.DESER_PHP,
-        title: 'Insecure Deserialization - PHP',
-        description: 'Critical PHP deserialization vulnerability where unserialize() processes attacker-controlled data, enabling object injection attacks through magic methods like __wakeup(), __destruct(), or __toString() in application or framework classes for remote code execution.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID]: {
+        id: 121,
+        code: VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID,
+        title: 'Cookie Misconfiguration - __Secure- Prefix Violations',
+        description: 'Cookies with the __Secure- prefix are missing the Secure attribute, which defeats the prefix requirement and weakens transport security protections.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
+            severity: 'MEDIUM',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Never pass user input to unserialize(). Use json_decode() instead. If serialization is required, use allowed_classes option with explicit allowlist. Audit code for pop chains.',
+        remediation: 'Set the Secure attribute for all __Secure- cookies and ensure HTTPS is enforced across the application.',
     },
 
-    [VulnerabilityCode.DESER_PYTHON]: {
-        id: 79,
-        code: VulnerabilityCode.DESER_PYTHON,
-        title: 'Insecure Deserialization - Python',
-        description: 'Critical Python deserialization vulnerability through pickle/cPickle processing of untrusted data, enabling remote code execution via __reduce__ method exploitation. Python pickle is inherently unsafe and should never process untrusted input.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.HEADER_DRIFT_CSP]: {
+        id: 122,
+        code: VulnerabilityCode.HEADER_DRIFT_CSP,
+        title: 'Header Drift - Content-Security-Policy Inconsistent',
+        description: 'Content-Security-Policy is present on some paths but missing on others, creating uneven defenses and potentially exposing unprotected routes to script injection or content loading risks.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Never pickle untrusted data. Use JSON or other safe formats. If pickle is required, use cryptographic signatures to verify data integrity before deserialization.',
+        remediation: 'Apply CSP consistently across relevant responses, including error and authentication pages, to avoid gaps in policy coverage.',
     },
 
-    [VulnerabilityCode.DESER_DOTNET]: {
-        id: 80,
-        code: VulnerabilityCode.DESER_DOTNET,
-        title: 'Insecure Deserialization - .NET',
-        description: 'Critical .NET deserialization vulnerability through BinaryFormatter, ObjectStateFormatter, LosFormatter, or other dangerous formatters processing untrusted data, enabling remote code execution through gadget chains in the .NET runtime or third-party libraries.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.HEADER_DRIFT_HSTS]: {
+        id: 123,
+        code: VulnerabilityCode.HEADER_DRIFT_HSTS,
+        title: 'Header Drift - Strict-Transport-Security Inconsistent',
+        description: 'Strict-Transport-Security is present on some paths but missing on others, reducing the effectiveness of HTTPS enforcement and creating mixed transport behavior across the site.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Avoid BinaryFormatter for untrusted data. Use System.Text.Json or XmlSerializer with known types. For legacy code, implement SerializationBinder to restrict deserializable types.',
+        remediation: 'Ensure HSTS is set uniformly on HTTPS responses so the browser can enforce strict transport for the entire origin.',
     },
 
-    [VulnerabilityCode.DESER_RUBY]: {
-        id: 81,
-        code: VulnerabilityCode.DESER_RUBY,
-        title: 'Insecure Deserialization - Ruby',
-        description: 'Critical Ruby deserialization vulnerability through Marshal.load or YAML.load processing untrusted data, enabling remote code execution through Ruby object instantiation gadgets that execute arbitrary code during object reconstruction.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE]: {
+        id: 124,
+        code: VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE,
+        title: 'Header Drift - X-Content-Type-Options Inconsistent',
+        description: 'X-Content-Type-Options is present on some paths but missing on others, allowing inconsistent MIME sniffing behavior that could expose unprotected routes to content-type confusion.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Never Marshal.load untrusted data. Use JSON.parse instead. For YAML, use YAML.safe_load with permitted_classes option. Sign serialized data with HMAC for integrity.',
+        remediation: 'Apply X-Content-Type-Options: nosniff across all relevant responses to avoid inconsistent browser behavior.',
     },
 
-    [VulnerabilityCode.DESER_NODE]: {
-        id: 82,
-        code: VulnerabilityCode.DESER_NODE,
-        title: 'Insecure Deserialization - Node.js',
-        description: 'Critical Node.js deserialization vulnerability through node-serialize, funcster, or similar libraries that execute JavaScript during deserialization, enabling remote code execution when attacker-controlled serialized data containing functions or IIFE is processed.',
-        severity: 'critical',
-        category: 'injection',
-        scanner: 'deserialization',
+    [VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY]: {
+        id: 125,
+        code: VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY,
+        title: 'Header Drift - Referrer-Policy Inconsistent',
+        description: 'Referrer-Policy is present on some paths but missing on others, leading to inconsistent referrer leakage controls and potential exposure of sensitive URL data.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'security-headers',
         cvss: {
-            score: 9.8,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
-            severity: 'CRITICAL',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-502', name: 'Deserialization of Untrusted Data', url: 'https://cwe.mitre.org/data/definitions/502.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
-            { id: 'A08:2021', name: 'Software and Data Integrity Failures', url: 'https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/' },
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Never use serialization libraries that can deserialize functions. Use JSON.parse() for data interchange. Avoid node-serialize and similar libraries. Implement input validation.',
+        remediation: 'Set a consistent Referrer-Policy across responses to standardize referrer leakage controls.',
     },
 
-    [VulnerabilityCode.CLICK_PARTIAL_PROTECTION]: {
-        id: 83,
-        code: VulnerabilityCode.CLICK_PARTIAL_PROTECTION,
-        title: 'Clickjacking - Partial Protection',
-        description: 'Incomplete clickjacking protection where X-Frame-Options or frame-ancestors CSP is only applied on some pages, uses weak values like ALLOW-FROM with bypassable origins, or has inconsistent implementation allowing certain pages to be framed.',
+    [VulnerabilityCode.HEADER_DRIFT_XFRAME]: {
+        id: 126,
+        code: VulnerabilityCode.HEADER_DRIFT_XFRAME,
+        title: 'Header Drift - X-Frame-Options Inconsistent',
+        description: 'X-Frame-Options or equivalent framing controls are present on some paths but missing on others, creating uneven clickjacking protection across the site.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 3.7,
+            score: 3.1,
             vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
             severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-1021', name: 'Improper Restriction of Rendered UI Layers', url: 'https://cwe.mitre.org/data/definitions/1021.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Apply consistent frame protection across all pages. Use DENY or SAMEORIGIN rather than ALLOW-FROM. Audit all endpoints for missing protection. Use CSP frame-ancestors instead of X-Frame-Options.',
+        remediation: 'Apply X-Frame-Options or CSP frame-ancestors consistently to avoid unprotected pages.',
     },
 
-    [VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE]: {
-        id: 84,
-        code: VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE,
-        title: 'Missing Security Header - X-Content-Type-Options',
-        description: 'The application does not set X-Content-Type-Options: nosniff header, allowing browsers to perform MIME-type sniffing that can lead to XSS attacks when user-uploaded content is served with incorrect Content-Type and browsers execute it as script.',
+    [VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY]: {
+        id: 127,
+        code: VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY,
+        title: 'Header Drift - Permissions-Policy Inconsistent',
+        description: 'Permissions-Policy is present on some paths but missing on others, leading to inconsistent controls over browser features such as geolocation, camera, or microphone.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 3.7,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
             severity: 'LOW',
         },
         cwe: [
@@ -721,86 +1789,44 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Add X-Content-Type-Options: nosniff header to all responses. Ensure correct Content-Type headers are set for all resources. Validate file types before serving user uploads.',
-    },
-
-    [VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID]: {
-        id: 1009,
-        code: VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID,
-        title: 'Invalid Security Header - X-Content-Type-Options',
-        description: 'The X-Content-Type-Options header is present but misconfigured (not set to nosniff), which can allow MIME sniffing and reduce protection against content-type confusion.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.7,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set X-Content-Type-Options to nosniff on all responses to prevent MIME sniffing.',
-    },
-
-    [VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY]: {
-        id: 85,
-        code: VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY,
-        title: 'Missing Security Header - Referrer-Policy',
-        description: 'The application does not implement Referrer-Policy header, potentially leaking sensitive URL information including session tokens, user IDs, or query parameters to external sites when users click links or resources are loaded from third-party domains.',
+        remediation: 'Apply Permissions-Policy consistently for pages that should restrict access to sensitive browser features.',
+    },
+
+    [VulnerabilityCode.HEADER_DRIFT_COOP]: {
+        id: 128,
+        code: VulnerabilityCode.HEADER_DRIFT_COOP,
+        title: 'Header Drift - COOP Inconsistent',
+        description: 'Cross-Origin-Opener-Policy is present on some paths but missing on others, which can lead to uneven cross-origin isolation guarantees and inconsistent window isolation behavior.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
             score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
             severity: 'LOW',
         },
         cwe: [
-            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
         ],
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Implement Referrer-Policy header with strict-origin-when-cross-origin or no-referrer policy. Avoid passing sensitive data in URLs. Use POST requests for sensitive operations.',
-    },
-
-    [VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE]: {
-        id: 1010,
-        code: VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE,
-        title: 'Unsafe Referrer-Policy Configuration',
-        description: 'The Referrer-Policy header is set to a permissive value that can leak full URLs and sensitive query parameters to external origins.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Use strict-origin-when-cross-origin or no-referrer to minimize leakage of sensitive URL data.',
-    },
+        remediation: 'Apply COOP consistently where cross-origin isolation is required and validate the policy across all relevant routes.',
+    },
 
-    [VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY]: {
-        id: 86,
-        code: VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY,
-        title: 'Missing Security Header - Permissions-Policy',
-        description: 'The application does not implement Permissions-Policy (formerly Feature-Policy) header, allowing embedded frames or malicious scripts to access sensitive browser features like camera, microphone, geolocation, or payment APIs without explicit permission.',
-        severity: 'info',
+    [VulnerabilityCode.HEADER_DRIFT_COEP]: {
+        id: 129,
+        code: VulnerabilityCode.HEADER_DRIFT_COEP,
+        title: 'Header Drift - COEP Inconsistent',
+        description: 'Cross-Origin-Embedder-Policy is present on some paths but missing on others, resulting in inconsistent embedding restrictions and cross-origin isolation posture.',
+        severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 2.0,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
             severity: 'LOW',
         },
         cwe: [
@@ -809,21 +1835,22 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Add Permissions-Policy header restricting access to sensitive features. Disable features not needed by the application. Use () syntax to disallow features for all origins.',
+        remediation: 'Apply COEP consistently on routes that are intended to enforce cross-origin embedding controls.',
     },
 
-    [VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION]: {
-        id: 87,
-        code: VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION,
-        title: 'Missing Security Header - X-XSS-Protection',
-        description: 'The legacy X-XSS-Protection header is not set. While deprecated in modern browsers, it can provide defense-in-depth for older browsers that still honor this header for their built-in XSS auditor feature.',
-        severity: 'info',
+    [VulnerabilityCode.HEADER_DRIFT_CORP]: {
+        id: 130,
+        code: VulnerabilityCode.HEADER_DRIFT_CORP,
+        title: 'Header Drift - CORP Inconsistent',
+        description: 'Cross-Origin-Resource-Policy is present on some paths but missing on others, which can leave inconsistent controls on resource sharing and embedding across the application.',
+        severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
-            score: 0.0,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N',
-            severity: 'NONE',
+            score: 3.1,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
+            severity: 'LOW',
         },
         cwe: [
             { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
@@ -831,514 +1858,8 @@ export const CONFIG_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
         owasp: [
             { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
         ],
-        remediation: 'Set X-XSS-Protection: 0 to disable (recommended per OWASP) or use CSP instead. The XSS auditor has been removed from modern browsers due to security issues with block mode.',
-    },
-
-    [VulnerabilityCode.HEADER_COEP_WITHOUT_COOP]: {
-        id: 108,
-        code: VulnerabilityCode.HEADER_COEP_WITHOUT_COOP,
-        title: 'Header Misconfiguration - COEP Without COOP',
-        description: 'Cross-Origin-Embedder-Policy (COEP) is set without Cross-Origin-Opener-Policy (COOP), which can create inconsistent cross-origin isolation behavior and indicate incomplete or misapplied security header strategy for isolation-sensitive applications.',
-        severity: 'info',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 2.0,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'If cross-origin isolation is required, deploy COEP together with COOP and validate the intended policy combination. Otherwise remove COEP to avoid confusing or inconsistent isolation posture.',
-    },
-
-    [VulnerabilityCode.HEADER_CORP_UNUSUAL]: {
-        id: 109,
-        code: VulnerabilityCode.HEADER_CORP_UNUSUAL,
-        title: 'Header Misconfiguration - Unusual CORP Value',
-        description: 'Cross-Origin-Resource-Policy (CORP) is set to a non-standard value, which may indicate a misconfiguration that provides no effective protection or creates unpredictable resource loading behavior across origins.',
-        severity: 'info',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 2.0,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Use valid CORP values (same-origin, same-site, or cross-origin) and confirm the chosen policy aligns with the resource sharing model of the application.',
-    },
-
-    [VulnerabilityCode.HEADER_EXPECT_CT_PRESENT]: {
-        id: 110,
-        code: VulnerabilityCode.HEADER_EXPECT_CT_PRESENT,
-        title: 'Deprecated Header - Expect-CT Present',
-        description: 'The Expect-CT header is present even though the feature is deprecated and no longer enforced by major browsers, adding unnecessary configuration surface without meaningful security benefit.',
-        severity: 'info',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 0.0,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N',
-            severity: 'NONE',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Remove Expect-CT unless you have a legacy operational requirement, and focus on TLS configuration and certificate transparency monitoring via modern tooling.',
-    },
-
-    [VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT]: {
-        id: 111,
-        code: VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT,
-        title: 'Information Exposure - Server Header Present',
-        description: 'The Server header reveals technology or version details that can assist attackers with fingerprinting and targeted exploitation, increasing the likelihood of tailored attacks against known software weaknesses.',
-        severity: 'info',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Configure the web server or reverse proxy to minimize or remove Server header details and avoid exposing version strings in responses.',
-    },
-
-    [VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT]: {
-        id: 112,
-        code: VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT,
-        title: 'Information Exposure - X-Powered-By Present',
-        description: 'The X-Powered-By header discloses framework or runtime information that can be used to fingerprint the application stack and target known vulnerabilities in specific platforms or versions.',
-        severity: 'info',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-200', name: 'Information Exposure', url: 'https://cwe.mitre.org/data/definitions/200.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Disable X-Powered-By headers in application frameworks or reverse proxies to reduce stack fingerprinting exposure.',
-    },
-
-    [VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED]: {
-        id: 113,
-        code: VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED,
-        title: 'Deprecated Header - X-XSS-Protection Enabled',
-        description: 'The X-XSS-Protection header is enabled, which is deprecated and can introduce security risks or inconsistent behavior in legacy browsers due to the removed XSS auditor feature.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Prefer modern CSP protections and set X-XSS-Protection: 0 or remove the header to avoid relying on deprecated behavior.',
-    },
-
-    [VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE]: {
-        id: 114,
-        code: VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE,
-        title: 'Cookie Misconfiguration - SameSite=None Without Secure',
-        description: 'A cookie is configured with SameSite=None but lacks the Secure attribute, enabling cross-site transmission over unencrypted connections and undermining cookie integrity and confidentiality controls.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set Secure when SameSite=None is used and ensure the application is served exclusively over HTTPS.',
-    },
-
-    [VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE]: {
-        id: 115,
-        code: VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE,
-        title: 'Cookie Misconfiguration - Session Cookie Missing Secure',
-        description: 'Session or authentication cookies are missing the Secure attribute, allowing them to be transmitted over unencrypted connections and increasing the risk of session hijacking or credential theft.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.1,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply the Secure attribute to all session cookies and enforce HTTPS with HSTS to prevent downgrade to plaintext.',
-    },
-
-    [VulnerabilityCode.COOKIE_MISSING_SECURE]: {
-        id: 116,
-        code: VulnerabilityCode.COOKIE_MISSING_SECURE,
-        title: 'Cookie Misconfiguration - Missing Secure Attribute',
-        description: 'Cookies are set without the Secure attribute, permitting transmission over plaintext HTTP and exposing cookie contents to network interception or manipulation.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-614', name: 'Sensitive Cookie in HTTPS Session Without Secure Attribute', url: 'https://cwe.mitre.org/data/definitions/614.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set the Secure attribute on cookies that should only be transmitted over HTTPS.',
-    },
-
-    [VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY]: {
-        id: 117,
-        code: VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY,
-        title: 'Cookie Misconfiguration - Session Cookie Missing HttpOnly',
-        description: 'Session or authentication cookies are missing the HttpOnly attribute, allowing client-side scripts to access sensitive cookie values and increasing the impact of XSS attacks.',
-        severity: 'high',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 7.1,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N',
-            severity: 'HIGH',
-        },
-        cwe: [
-            { id: 'CWE-1004', name: 'Sensitive Cookie Without HttpOnly Flag', url: 'https://cwe.mitre.org/data/definitions/1004.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set HttpOnly on session cookies to reduce access from client-side scripts and pair with CSP to mitigate XSS risk.',
-    },
-
-    [VulnerabilityCode.COOKIE_MISSING_HTTPONLY]: {
-        id: 118,
-        code: VulnerabilityCode.COOKIE_MISSING_HTTPONLY,
-        title: 'Cookie Misconfiguration - Missing HttpOnly Attribute',
-        description: 'Cookies are missing the HttpOnly attribute, allowing JavaScript access to cookie values and increasing the potential impact of client-side script injection.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-1004', name: 'Sensitive Cookie Without HttpOnly Flag', url: 'https://cwe.mitre.org/data/definitions/1004.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Add HttpOnly to cookies that should not be accessed by JavaScript to reduce the impact of XSS.',
-    },
-
-    [VulnerabilityCode.COOKIE_MISSING_SAMESITE]: {
-        id: 119,
-        code: VulnerabilityCode.COOKIE_MISSING_SAMESITE,
-        title: 'Cookie Misconfiguration - Missing SameSite Attribute',
-        description: 'Cookies do not specify SameSite, which can allow cross-site requests to include cookies by default and increase exposure to CSRF-style attacks or cross-site leakage.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 4.3,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set SameSite=Lax for general cookies or SameSite=Strict where appropriate to reduce cross-site cookie inclusion.',
-    },
-
-    [VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID]: {
-        id: 120,
-        code: VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID,
-        title: 'Cookie Misconfiguration - __Host- Prefix Violations',
-        description: 'Cookies with the __Host- prefix do not meet required attributes (Secure, Path=/, no Domain), weakening the protections provided by host-only cookie semantics.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Ensure __Host- cookies include Secure, Path=/, and omit the Domain attribute to preserve host-only guarantees.',
-    },
-
-    [VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID]: {
-        id: 121,
-        code: VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID,
-        title: 'Cookie Misconfiguration - __Secure- Prefix Violations',
-        description: 'Cookies with the __Secure- prefix are missing the Secure attribute, which defeats the prefix requirement and weakens transport security protections.',
-        severity: 'medium',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 5.3,
-            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N',
-            severity: 'MEDIUM',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set the Secure attribute for all __Secure- cookies and ensure HTTPS is enforced across the application.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_CSP]: {
-        id: 122,
-        code: VulnerabilityCode.HEADER_DRIFT_CSP,
-        title: 'Header Drift - Content-Security-Policy Inconsistent',
-        description: 'Content-Security-Policy is present on some paths but missing on others, creating uneven defenses and potentially exposing unprotected routes to script injection or content loading risks.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply CSP consistently across relevant responses, including error and authentication pages, to avoid gaps in policy coverage.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_HSTS]: {
-        id: 123,
-        code: VulnerabilityCode.HEADER_DRIFT_HSTS,
-        title: 'Header Drift - Strict-Transport-Security Inconsistent',
-        description: 'Strict-Transport-Security is present on some paths but missing on others, reducing the effectiveness of HTTPS enforcement and creating mixed transport behavior across the site.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Ensure HSTS is set uniformly on HTTPS responses so the browser can enforce strict transport for the entire origin.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE]: {
-        id: 124,
-        code: VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE,
-        title: 'Header Drift - X-Content-Type-Options Inconsistent',
-        description: 'X-Content-Type-Options is present on some paths but missing on others, allowing inconsistent MIME sniffing behavior that could expose unprotected routes to content-type confusion.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply X-Content-Type-Options: nosniff across all relevant responses to avoid inconsistent browser behavior.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY]: {
-        id: 125,
-        code: VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY,
-        title: 'Header Drift - Referrer-Policy Inconsistent',
-        description: 'Referrer-Policy is present on some paths but missing on others, leading to inconsistent referrer leakage controls and potential exposure of sensitive URL data.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Set a consistent Referrer-Policy across responses to standardize referrer leakage controls.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_XFRAME]: {
-        id: 126,
-        code: VulnerabilityCode.HEADER_DRIFT_XFRAME,
-        title: 'Header Drift - X-Frame-Options Inconsistent',
-        description: 'X-Frame-Options or equivalent framing controls are present on some paths but missing on others, creating uneven clickjacking protection across the site.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply X-Frame-Options or CSP frame-ancestors consistently to avoid unprotected pages.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY]: {
-        id: 127,
-        code: VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY,
-        title: 'Header Drift - Permissions-Policy Inconsistent',
-        description: 'Permissions-Policy is present on some paths but missing on others, leading to inconsistent controls over browser features such as geolocation, camera, or microphone.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply Permissions-Policy consistently for pages that should restrict access to sensitive browser features.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_COOP]: {
-        id: 128,
-        code: VulnerabilityCode.HEADER_DRIFT_COOP,
-        title: 'Header Drift - COOP Inconsistent',
-        description: 'Cross-Origin-Opener-Policy is present on some paths but missing on others, which can lead to uneven cross-origin isolation guarantees and inconsistent window isolation behavior.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply COOP consistently where cross-origin isolation is required and validate the policy across all relevant routes.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_COEP]: {
-        id: 129,
-        code: VulnerabilityCode.HEADER_DRIFT_COEP,
-        title: 'Header Drift - COEP Inconsistent',
-        description: 'Cross-Origin-Embedder-Policy is present on some paths but missing on others, resulting in inconsistent embedding restrictions and cross-origin isolation posture.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply COEP consistently on routes that are intended to enforce cross-origin embedding controls.',
-    },
-
-    [VulnerabilityCode.HEADER_DRIFT_CORP]: {
-        id: 130,
-        code: VulnerabilityCode.HEADER_DRIFT_CORP,
-        title: 'Header Drift - CORP Inconsistent',
-        description: 'Cross-Origin-Resource-Policy is present on some paths but missing on others, which can leave inconsistent controls on resource sharing and embedding across the application.',
-        severity: 'low',
-        category: 'configuration',
-        scanner: 'security-headers',
-        cvss: {
-            score: 3.1,
-            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N',
-            severity: 'LOW',
-        },
-        cwe: [
-            { id: 'CWE-693', name: 'Protection Mechanism Failure', url: 'https://cwe.mitre.org/data/definitions/693.html' },
-        ],
-        owasp: [
-            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
-        ],
-        remediation: 'Apply CORP consistently where resource sharing policies should be enforced across all relevant responses.',
-    },
-};
+        remediation: 'Apply CORP consistently where resource sharing policies should be enforced across all relevant responses.',
+    },
+};
 
 export default CONFIG_VULNERABILITIES;