@zerothreatai/vulnerability-registry 3.0.0 → 5.0.0

package/dist/categories/configuration.js

@@ -9,11 +9,12 @@ export const CONFIG_VULNERABILITIES = {
     // SECURITY HEADERS
     // ========================================
     [VulnerabilityCode.HEADER_MISSING_CSP]: {
-        id: 69,
+        id: 200,
         code: VulnerabilityCode.HEADER_MISSING_CSP,
         title: 'Missing Security Header - Content-Security-Policy',
         description: 'The application does not implement Content-Security-Policy header, leaving it vulnerable to cross-site scripting attacks that could be mitigated by restricting the sources from which scripts, styles, and other resources can be loaded into the page.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -30,11 +31,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Implement Content-Security-Policy header with strict directives. Start with default-src self and progressively add required sources. Use nonce-based CSP for inline scripts.',
     },
     [VulnerabilityCode.HEADER_MISSING_HSTS]: {
-        id: 70,
+        id: 201,
         code: VulnerabilityCode.HEADER_MISSING_HSTS,
         title: 'Missing Security Header - Strict-Transport-Security',
         description: 'The application does not implement HSTS (HTTP Strict Transport Security) header, leaving users vulnerable to SSL stripping attacks and man-in-the-middle downgrades from HTTPS to HTTP connections on initial visits or after cookie expiration.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -51,11 +53,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add Strict-Transport-Security header with max-age of at least 31536000 (1 year). Include includeSubDomains directive. Consider HSTS preloading for maximum protection.',
     },
     [VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE]: {
-        id: 1011,
+        id: 202,
         code: VulnerabilityCode.HEADER_HSTS_BAD_MAX_AGE,
         title: 'HSTS Misconfiguration - Invalid Max-Age',
         description: 'The Strict-Transport-Security header uses an invalid or malformed max-age value, preventing reliable HTTPS enforcement.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -72,11 +75,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set a valid numeric max-age on Strict-Transport-Security (at least 31536000).',
     },
     [VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE]: {
-        id: 1012,
+        id: 203,
         code: VulnerabilityCode.HEADER_HSTS_SHORT_MAX_AGE,
         title: 'HSTS Misconfiguration - Max-Age Too Short',
         description: 'The Strict-Transport-Security header uses a short max-age value that weakens HTTPS enforcement and allows downgrade risk to return quickly.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -93,11 +97,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Increase max-age to at least 31536000 (1 year) to provide durable HTTPS enforcement.',
     },
     [VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS]: {
-        id: 1013,
+        id: 204,
         code: VulnerabilityCode.HEADER_HSTS_NO_INCLUDESUBDOMAINS,
         title: 'HSTS Misconfiguration - Missing includeSubDomains',
         description: 'The Strict-Transport-Security header is missing includeSubDomains, leaving subdomains unprotected from downgrade and stripping attacks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -114,11 +119,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add includeSubDomains to the HSTS header to protect all subdomains.',
     },
     [VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE]: {
-        id: 1018,
+        id: 205,
         code: VulnerabilityCode.HEADER_HSTS_PRELOAD_LOW_MAX_AGE,
         title: 'HSTS Preload Requirements Not Met',
         description: 'The HSTS header indicates preload intent but does not meet preload requirements, such as a sufficiently long max-age or includeSubDomains, reducing preload effectiveness.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -135,11 +141,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Ensure HSTS max-age is at least 31536000, include includeSubDomains, and add preload before submitting to the preload list.',
     },
     [VulnerabilityCode.HEADER_MISSING_XFRAME]: {
-        id: 71,
+        id: 206,
         code: VulnerabilityCode.HEADER_MISSING_XFRAME,
         title: 'Missing Security Header - X-Frame-Options',
         description: 'The application does not set X-Frame-Options header, making it vulnerable to clickjacking attacks where malicious websites can embed the application in invisible iframes and trick users into performing unintended actions through deceptive UI overlays.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -156,11 +163,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set X-Frame-Options header to DENY or SAMEORIGIN. Use Content-Security-Policy frame-ancestors directive for more granular control. Both headers can be used together for compatibility.',
     },
     [VulnerabilityCode.HEADER_WEAK_CSP]: {
-        id: 72,
+        id: 207,
         code: VulnerabilityCode.HEADER_WEAK_CSP,
         title: 'Weak Content-Security-Policy Configuration',
         description: 'The Content-Security-Policy header contains unsafe directives like unsafe-inline, unsafe-eval, or overly permissive source allowlists that significantly reduce its effectiveness as an XSS mitigation and may create false sense of security.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -177,11 +185,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove unsafe-inline and unsafe-eval directives. Use nonce-based or hash-based CSP for inline scripts. Restrict source allowlists to specific trusted domains rather than wildcards.',
     },
     [VulnerabilityCode.HEADER_CSP_REPORT_ONLY]: {
-        id: 1001,
+        id: 208,
         code: VulnerabilityCode.HEADER_CSP_REPORT_ONLY,
         title: 'Content-Security-Policy Report-Only Enabled',
         description: 'The Content-Security-Policy header is deployed in report-only mode, which does not enforce protections and allows unsafe content to execute while only logging violations.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -198,11 +207,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Switch to enforcing Content-Security-Policy once violations are reviewed. Use report-only during rollout, then enforce with strict directives.',
     },
     [VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES]: {
-        id: 1002,
+        id: 209,
         code: VulnerabilityCode.HEADER_CSP_WEAK_DIRECTIVES,
         title: 'Content-Security-Policy Contains Unsafe Directives',
         description: 'The Content-Security-Policy header includes unsafe directives such as unsafe-inline or unsafe-eval that reduce XSS protection and allow risky script execution paths.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -219,11 +229,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove unsafe-inline and unsafe-eval directives. Replace inline scripts with nonces or hashes and restrict sources to trusted domains.',
     },
     [VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT]: {
-        id: 1003,
+        id: 210,
         code: VulnerabilityCode.HEADER_CSP_DATA_URI_SCRIPT,
         title: 'Content-Security-Policy Allows data: in script-src',
         description: 'The CSP allows data: URIs for script execution, which can enable script injection through crafted data URLs and weaken XSS protections.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -240,11 +251,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove data: from script-src. Use nonce or hash-based CSP for any required inline scripts.',
     },
     [VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT]: {
-        id: 1004,
+        id: 211,
         code: VulnerabilityCode.HEADER_CSP_BLOB_URI_SCRIPT,
         title: 'Content-Security-Policy Allows blob: in script-src',
         description: 'The CSP allows blob: URIs for script execution, which can be abused to load attacker-controlled scripts in some contexts and weaken XSS mitigations.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -261,11 +273,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove blob: from script-src unless strictly required. Use a narrower allowlist or nonces for trusted scripts.',
     },
     [VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT]: {
-        id: 1005,
+        id: 212,
         code: VulnerabilityCode.HEADER_CSP_WILDCARD_DEFAULT,
         title: 'Content-Security-Policy default-src Uses Wildcard',
         description: 'The CSP default-src directive allows all origins, which effectively disables the protection and allows untrusted content to load.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -282,11 +295,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Replace wildcard default-src with explicit trusted origins and tighten resource-specific directives.',
     },
     [VulnerabilityCode.HEADER_CSP_NO_BASE_URI]: {
-        id: 1006,
+        id: 213,
         code: VulnerabilityCode.HEADER_CSP_NO_BASE_URI,
         title: 'Content-Security-Policy Missing base-uri Directive',
         description: 'The CSP does not include a base-uri directive, allowing the base URL to be set by injected markup and enabling abuse of relative URL resolution.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -303,11 +317,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add base-uri \'self\' (or a strict allowlist) to CSP to prevent base tag abuse.',
     },
     [VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC]: {
-        id: 1007,
+        id: 214,
         code: VulnerabilityCode.HEADER_CSP_NO_OBJECT_SRC,
         title: 'Content-Security-Policy Missing object-src Directive',
         description: 'The CSP does not include an object-src directive, allowing embedded objects to load from arbitrary origins and weakening defense-in-depth against plugin-based risks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -324,11 +339,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add object-src \'none\' (or a strict allowlist) to CSP to prevent plugin content loading.',
     },
     [VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS]: {
-        id: 1008,
+        id: 215,
         code: VulnerabilityCode.HEADER_CSP_NO_FRAME_ANCESTORS,
         title: 'Content-Security-Policy Missing frame-ancestors Directive',
         description: 'The CSP does not include a frame-ancestors directive, leaving pages potentially frameable and vulnerable to clickjacking attacks.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -345,11 +361,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add frame-ancestors \'none\' or a strict allowlist to CSP to prevent clickjacking.',
     },
     [VulnerabilityCode.HEADER_CORS_MISCONFIGURED]: {
-        id: 73,
+        id: 216,
         code: VulnerabilityCode.HEADER_CORS_MISCONFIGURED,
         title: 'CORS Misconfiguration',
         description: 'Cross-Origin Resource Sharing is misconfigured with overly permissive Access-Control-Allow-Origin headers including wildcard (*) with credentials, or dynamic reflection of Origin header without proper validation, enabling cross-origin data theft.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -366,11 +383,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Implement strict Origin validation with allowlist of trusted domains. Never reflect Origin header without validation. Do not use wildcard with Access-Control-Allow-Credentials.',
     },
     [VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS]: {
-        id: 1014,
+        id: 217,
         code: VulnerabilityCode.HEADER_CORS_STAR_WITH_CREDENTIALS,
         title: 'CORS Wildcard With Credentials',
         description: 'Access-Control-Allow-Origin is set to * while Access-Control-Allow-Credentials is enabled, which browsers block but signals a dangerous CORS policy that can be misapplied in some environments.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -387,11 +405,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Never use wildcard origins with credentials. Replace * with an explicit allowlist and set Vary: Origin.',
     },
     [VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY]: {
-        id: 1015,
+        id: 218,
         code: VulnerabilityCode.HEADER_CORS_ORIGIN_REFLECT_NO_VARY,
         title: 'CORS Origin Reflection Without Vary',
         description: 'The Origin header is reflected in Access-Control-Allow-Origin without Vary: Origin, which can lead to cache poisoning and unintended cross-origin access.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -408,11 +427,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Validate origins against an allowlist and always include Vary: Origin when dynamically setting Access-Control-Allow-Origin.',
     },
     [VulnerabilityCode.HEADER_CORS_NULL_ORIGIN]: {
-        id: 1016,
+        id: 219,
         code: VulnerabilityCode.HEADER_CORS_NULL_ORIGIN,
         title: 'CORS Allows Null Origin',
         description: 'Access-Control-Allow-Origin allows the null origin, enabling requests from opaque origins such as sandboxed iframes and file URLs that can be abused to access sensitive data.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -429,11 +449,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove null from allowed origins. Restrict CORS to explicit trusted domains only.',
     },
     [VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN]: {
-        id: 1017,
+        id: 220,
         code: VulnerabilityCode.HEADER_CORS_WILDCARD_SUBDOMAIN,
         title: 'CORS Allows Wildcard Subdomains',
         description: 'CORS policies allow wildcard subdomains that can be abused if any subdomain is compromised or can be controlled by untrusted parties.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -452,12 +473,454 @@ export const CONFIG_VULNERABILITIES = {
     // ========================================
     // DIRECTORY BROWSING
     // ========================================
+    [VulnerabilityCode.DIRBROWSE_GENERIC]: {
+        id: 221,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC,
+        title: 'Directory Listing Enabled (Generic)',
+        description: 'Directory listing is enabled and exposes directory contents to unauthenticated visitors, revealing application structure and file names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing in the web server configuration and ensure directories have index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE]: {
+        id: 222,
+        code: VulnerabilityCode.DIRBROWSE_GENERIC_SENSITIVE,
+        title: 'Directory Listing Exposing Sensitive Content (Generic)',
+        description: 'Directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listing and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_APACHE]: {
+        id: 223,
+        code: VulnerabilityCode.DIRBROWSE_APACHE,
+        title: 'Apache Autoindex Enabled',
+        description: 'Apache autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in Apache (Options -Indexes) and add index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE]: {
+        id: 224,
+        code: VulnerabilityCode.DIRBROWSE_APACHE_SENSITIVE,
+        title: 'Apache Autoindex Exposing Sensitive Content',
+        description: 'Apache autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_NGINX]: {
+        id: 225,
+        code: VulnerabilityCode.DIRBROWSE_NGINX,
+        title: 'Nginx Autoindex Enabled',
+        description: 'Nginx autoindex is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex in nginx (autoindex off) and add index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE]: {
+        id: 226,
+        code: VulnerabilityCode.DIRBROWSE_NGINX_SENSITIVE,
+        title: 'Nginx Autoindex Exposing Sensitive Content',
+        description: 'Nginx autoindex is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable autoindex and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_IIS]: {
+        id: 227,
+        code: VulnerabilityCode.DIRBROWSE_IIS,
+        title: 'IIS Directory Browsing Enabled',
+        description: 'IIS directory browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing in IIS and ensure directories have index files.',
+    },
+    [VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE]: {
+        id: 228,
+        code: VulnerabilityCode.DIRBROWSE_IIS_SENSITIVE,
+        title: 'IIS Directory Browsing Exposing Sensitive Content',
+        description: 'IIS directory browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory browsing and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_TOMCAT]: {
+        id: 229,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT,
+        title: 'Tomcat Directory Listing Enabled',
+        description: 'Tomcat directory listing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings in Tomcat and add index files to web directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE]: {
+        id: 230,
+        code: VulnerabilityCode.DIRBROWSE_TOMCAT_SENSITIVE,
+        title: 'Tomcat Directory Listing Exposing Sensitive Content',
+        description: 'Tomcat directory listing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable directory listings and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_CADDY]: {
+        id: 231,
+        code: VulnerabilityCode.DIRBROWSE_CADDY,
+        title: 'Caddy File Server Browsing Enabled',
+        description: 'Caddy file server browsing is enabled, exposing directory contents to unauthenticated visitors.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse in Caddy or restrict browsing to trusted users.',
+    },
+    [VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE]: {
+        id: 232,
+        code: VulnerabilityCode.DIRBROWSE_CADDY_SENSITIVE,
+        title: 'Caddy File Server Browsing Exposing Sensitive Content',
+        description: 'Caddy file server browsing is enabled on a directory containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable file_server browse and remove sensitive files from web-accessible directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_WEBDAV]: {
+        id: 233,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV,
+        title: 'WebDAV Directory Listing Enabled',
+        description: 'WebDAV responses expose directory contents, allowing unauthenticated browsing of files and folders.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing or restrict access with authentication and authorization.',
+    },
+    [VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE]: {
+        id: 234,
+        code: VulnerabilityCode.DIRBROWSE_WEBDAV_SENSITIVE,
+        title: 'WebDAV Directory Listing Exposing Sensitive Content',
+        description: 'WebDAV responses expose directories containing sensitive files such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-548', name: 'Directory Listing', url: 'https://cwe.mitre.org/data/definitions/548.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable unauthenticated WebDAV browsing and remove sensitive files from exposed directories.',
+    },
+    [VulnerabilityCode.DIRBROWSE_S3]: {
+        id: 235,
+        code: VulnerabilityCode.DIRBROWSE_S3,
+        title: 'S3 Bucket Listing Enabled',
+        description: 'An S3 bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public ListBucket access and restrict bucket policies to authorized principals.',
+    },
+    [VulnerabilityCode.DIRBROWSE_S3_SENSITIVE]: {
+        id: 236,
+        code: VulnerabilityCode.DIRBROWSE_S3_SENSITIVE,
+        title: 'S3 Bucket Listing Exposing Sensitive Content',
+        description: 'An S3 bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public ListBucket access and rotate any exposed credentials or secrets.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GCS]: {
+        id: 237,
+        code: VulnerabilityCode.DIRBROWSE_GCS,
+        title: 'GCS Bucket Listing Enabled',
+        description: 'A Google Cloud Storage bucket listing is exposed, allowing unauthenticated enumeration of object keys.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Restrict bucket IAM policies to authorized principals and disable anonymous listing.',
+    },
+    [VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE]: {
+        id: 238,
+        code: VulnerabilityCode.DIRBROWSE_GCS_SENSITIVE,
+        title: 'GCS Bucket Listing Exposing Sensitive Content',
+        description: 'A Google Cloud Storage bucket listing is exposed and includes sensitive objects such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB]: {
+        id: 239,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB,
+        title: 'Azure Blob Container Listing Enabled',
+        description: 'An Azure Blob container listing is exposed, allowing unauthenticated enumeration of blob names.',
+        severity: 'low',
+        levelId: 4,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 3.7,
+            vector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'LOW',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Disable public container listing and restrict access via SAS tokens or RBAC.',
+    },
+    [VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE]: {
+        id: 240,
+        code: VulnerabilityCode.DIRBROWSE_AZURE_BLOB_SENSITIVE,
+        title: 'Azure Blob Container Listing Exposing Sensitive Content',
+        description: 'An Azure Blob container listing is exposed and includes sensitive blobs such as backups, credentials, or configuration artifacts.',
+        severity: 'medium',
+        levelId: 3,
+        category: 'configuration',
+        scanner: 'directory-browsing',
+        cvss: {
+            score: 5.3,
+            vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+            severity: 'MEDIUM',
+        },
+        cwe: [
+            { id: 'CWE-200', name: 'Exposure of Sensitive Information to an Unauthorized Actor', url: 'https://cwe.mitre.org/data/definitions/200.html' },
+        ],
+        owasp: [
+            { id: 'A05:2021', name: 'Security Misconfiguration', url: 'https://owasp.org/Top10/A05_2021-Security_Misconfiguration/' },
+        ],
+        remediation: 'Remove public listing access and rotate any exposed credentials or secrets.',
+    },
+    // Legacy generic codes (keep for backward compatibility)
     [VulnerabilityCode.DIRBROWSE_ENABLED]: {
-        id: 74,
+        id: 241,
         code: VulnerabilityCode.DIRBROWSE_ENABLED,
         title: 'Directory Listing Enabled',
         description: 'Web server directory listing is enabled, exposing the contents of directories to anyone who browses to them without an index file. This reveals application structure, backup files, configuration files, and potentially sensitive data to attackers.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'directory-browsing',
         cvss: {
@@ -474,11 +937,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Disable directory listing in web server configuration (Options -Indexes in Apache, autoindex off in nginx). Ensure all directories have proper index files.',
     },
     [VulnerabilityCode.DIRBROWSE_SENSITIVE]: {
-        id: 75,
+        id: 242,
         code: VulnerabilityCode.DIRBROWSE_SENSITIVE,
         title: 'Directory Listing Exposing Sensitive Content',
         description: 'Directory listing is enabled on a directory containing sensitive files like backups, configuration files, source code, or credentials. This elevates the risk significantly as attackers can directly access sensitive information without guessing filenames.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'directory-browsing',
         cvss: {
@@ -498,11 +962,12 @@ export const CONFIG_VULNERABILITIES = {
     // CLICKJACKING
     // ========================================
     [VulnerabilityCode.CLICK_FRAMEABLE]: {
-        id: 76,
+        id: 243,
         code: VulnerabilityCode.CLICK_FRAMEABLE,
         title: 'Clickjacking - Page Frameable',
         description: 'The application pages can be embedded in iframes on malicious websites, enabling clickjacking attacks where attackers overlay transparent frames over deceptive UI elements to trick users into clicking hidden buttons or links that perform unintended actions.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -522,11 +987,12 @@ export const CONFIG_VULNERABILITIES = {
     // DESERIALIZATION
     // ========================================
     [VulnerabilityCode.DESER_JAVA]: {
-        id: 77,
+        id: 244,
         code: VulnerabilityCode.DESER_JAVA,
         title: 'Insecure Deserialization - Java',
         description: 'Critical Java deserialization vulnerability where untrusted serialized objects are processed, allowing attackers to achieve remote code execution through gadget chains in common libraries like Apache Commons Collections, Spring Framework, or other classpath dependencies.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -543,11 +1009,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Do not deserialize untrusted data. Use JSON or XML instead of Java serialization. Implement ObjectInputFilter (JEP 290) to restrict deserializable classes. Remove vulnerable gadget libraries.',
     },
     [VulnerabilityCode.DESER_PHP]: {
-        id: 78,
+        id: 245,
         code: VulnerabilityCode.DESER_PHP,
         title: 'Insecure Deserialization - PHP',
         description: 'Critical PHP deserialization vulnerability where unserialize() processes attacker-controlled data, enabling object injection attacks through magic methods like __wakeup(), __destruct(), or __toString() in application or framework classes for remote code execution.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -564,11 +1031,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Never pass user input to unserialize(). Use json_decode() instead. If serialization is required, use allowed_classes option with explicit allowlist. Audit code for pop chains.',
     },
     [VulnerabilityCode.DESER_PYTHON]: {
-        id: 79,
+        id: 246,
         code: VulnerabilityCode.DESER_PYTHON,
         title: 'Insecure Deserialization - Python',
         description: 'Critical Python deserialization vulnerability through pickle/cPickle processing of untrusted data, enabling remote code execution via __reduce__ method exploitation. Python pickle is inherently unsafe and should never process untrusted input.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -585,11 +1053,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Never pickle untrusted data. Use JSON or other safe formats. If pickle is required, use cryptographic signatures to verify data integrity before deserialization.',
     },
     [VulnerabilityCode.DESER_DOTNET]: {
-        id: 80,
+        id: 247,
         code: VulnerabilityCode.DESER_DOTNET,
         title: 'Insecure Deserialization - .NET',
         description: 'Critical .NET deserialization vulnerability through BinaryFormatter, ObjectStateFormatter, LosFormatter, or other dangerous formatters processing untrusted data, enabling remote code execution through gadget chains in the .NET runtime or third-party libraries.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -606,11 +1075,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Avoid BinaryFormatter for untrusted data. Use System.Text.Json or XmlSerializer with known types. For legacy code, implement SerializationBinder to restrict deserializable types.',
     },
     [VulnerabilityCode.DESER_RUBY]: {
-        id: 81,
+        id: 248,
         code: VulnerabilityCode.DESER_RUBY,
         title: 'Insecure Deserialization - Ruby',
         description: 'Critical Ruby deserialization vulnerability through Marshal.load or YAML.load processing untrusted data, enabling remote code execution through Ruby object instantiation gadgets that execute arbitrary code during object reconstruction.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -627,11 +1097,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Never Marshal.load untrusted data. Use JSON.parse instead. For YAML, use YAML.safe_load with permitted_classes option. Sign serialized data with HMAC for integrity.',
     },
     [VulnerabilityCode.DESER_NODE]: {
-        id: 82,
+        id: 249,
         code: VulnerabilityCode.DESER_NODE,
         title: 'Insecure Deserialization - Node.js',
         description: 'Critical Node.js deserialization vulnerability through node-serialize, funcster, or similar libraries that execute JavaScript during deserialization, enabling remote code execution when attacker-controlled serialized data containing functions or IIFE is processed.',
         severity: 'critical',
+        levelId: 1,
         category: 'injection',
         scanner: 'deserialization',
         cvss: {
@@ -648,11 +1119,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Never use serialization libraries that can deserialize functions. Use JSON.parse() for data interchange. Avoid node-serialize and similar libraries. Implement input validation.',
     },
     [VulnerabilityCode.CLICK_PARTIAL_PROTECTION]: {
-        id: 83,
+        id: 250,
         code: VulnerabilityCode.CLICK_PARTIAL_PROTECTION,
         title: 'Clickjacking - Partial Protection',
         description: 'Incomplete clickjacking protection where X-Frame-Options or frame-ancestors CSP is only applied on some pages, uses weak values like ALLOW-FROM with bypassable origins, or has inconsistent implementation allowing certain pages to be framed.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -669,11 +1141,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply consistent frame protection across all pages. Use DENY or SAMEORIGIN rather than ALLOW-FROM. Audit all endpoints for missing protection. Use CSP frame-ancestors instead of X-Frame-Options.',
     },
     [VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE]: {
-        id: 84,
+        id: 251,
         code: VulnerabilityCode.HEADER_MISSING_XCONTENT_TYPE,
         title: 'Missing Security Header - X-Content-Type-Options',
         description: 'The application does not set X-Content-Type-Options: nosniff header, allowing browsers to perform MIME-type sniffing that can lead to XSS attacks when user-uploaded content is served with incorrect Content-Type and browsers execute it as script.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -690,11 +1163,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add X-Content-Type-Options: nosniff header to all responses. Ensure correct Content-Type headers are set for all resources. Validate file types before serving user uploads.',
     },
     [VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID]: {
-        id: 1009,
+        id: 252,
         code: VulnerabilityCode.HEADER_XCONTENT_TYPE_INVALID,
         title: 'Invalid Security Header - X-Content-Type-Options',
         description: 'The X-Content-Type-Options header is present but misconfigured (not set to nosniff), which can allow MIME sniffing and reduce protection against content-type confusion.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -711,11 +1185,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set X-Content-Type-Options to nosniff on all responses to prevent MIME sniffing.',
     },
     [VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY]: {
-        id: 85,
+        id: 253,
         code: VulnerabilityCode.HEADER_MISSING_REFERRER_POLICY,
         title: 'Missing Security Header - Referrer-Policy',
         description: 'The application does not implement Referrer-Policy header, potentially leaking sensitive URL information including session tokens, user IDs, or query parameters to external sites when users click links or resources are loaded from third-party domains.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -732,11 +1207,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Implement Referrer-Policy header with strict-origin-when-cross-origin or no-referrer policy. Avoid passing sensitive data in URLs. Use POST requests for sensitive operations.',
     },
     [VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE]: {
-        id: 1010,
+        id: 254,
         code: VulnerabilityCode.HEADER_REFERRER_POLICY_UNSAFE,
         title: 'Unsafe Referrer-Policy Configuration',
         description: 'The Referrer-Policy header is set to a permissive value that can leak full URLs and sensitive query parameters to external origins.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -753,11 +1229,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Use strict-origin-when-cross-origin or no-referrer to minimize leakage of sensitive URL data.',
     },
     [VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY]: {
-        id: 86,
+        id: 255,
         code: VulnerabilityCode.HEADER_MISSING_PERMISSIONS_POLICY,
         title: 'Missing Security Header - Permissions-Policy',
         description: 'The application does not implement Permissions-Policy (formerly Feature-Policy) header, allowing embedded frames or malicious scripts to access sensitive browser features like camera, microphone, geolocation, or payment APIs without explicit permission.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -774,11 +1251,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add Permissions-Policy header restricting access to sensitive features. Disable features not needed by the application. Use () syntax to disallow features for all origins.',
     },
     [VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION]: {
-        id: 87,
+        id: 256,
         code: VulnerabilityCode.HEADER_MISSING_XSS_PROTECTION,
         title: 'Missing Security Header - X-XSS-Protection',
         description: 'The legacy X-XSS-Protection header is not set. While deprecated in modern browsers, it can provide defense-in-depth for older browsers that still honor this header for their built-in XSS auditor feature.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -795,11 +1273,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set X-XSS-Protection: 0 to disable (recommended per OWASP) or use CSP instead. The XSS auditor has been removed from modern browsers due to security issues with block mode.',
     },
     [VulnerabilityCode.HEADER_COEP_WITHOUT_COOP]: {
-        id: 108,
+        id: 257,
         code: VulnerabilityCode.HEADER_COEP_WITHOUT_COOP,
         title: 'Header Misconfiguration - COEP Without COOP',
         description: 'Cross-Origin-Embedder-Policy (COEP) is set without Cross-Origin-Opener-Policy (COOP), which can create inconsistent cross-origin isolation behavior and indicate incomplete or misapplied security header strategy for isolation-sensitive applications.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -816,11 +1295,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'If cross-origin isolation is required, deploy COEP together with COOP and validate the intended policy combination. Otherwise remove COEP to avoid confusing or inconsistent isolation posture.',
     },
     [VulnerabilityCode.HEADER_CORP_UNUSUAL]: {
-        id: 109,
+        id: 258,
         code: VulnerabilityCode.HEADER_CORP_UNUSUAL,
         title: 'Header Misconfiguration - Unusual CORP Value',
         description: 'Cross-Origin-Resource-Policy (CORP) is set to a non-standard value, which may indicate a misconfiguration that provides no effective protection or creates unpredictable resource loading behavior across origins.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -837,11 +1317,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Use valid CORP values (same-origin, same-site, or cross-origin) and confirm the chosen policy aligns with the resource sharing model of the application.',
     },
     [VulnerabilityCode.HEADER_EXPECT_CT_PRESENT]: {
-        id: 110,
+        id: 259,
         code: VulnerabilityCode.HEADER_EXPECT_CT_PRESENT,
         title: 'Deprecated Header - Expect-CT Present',
         description: 'The Expect-CT header is present even though the feature is deprecated and no longer enforced by major browsers, adding unnecessary configuration surface without meaningful security benefit.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -858,11 +1339,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Remove Expect-CT unless you have a legacy operational requirement, and focus on TLS configuration and certificate transparency monitoring via modern tooling.',
     },
     [VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT]: {
-        id: 111,
+        id: 260,
         code: VulnerabilityCode.HEADER_SERVER_HEADER_PRESENT,
         title: 'Information Exposure - Server Header Present',
         description: 'The Server header reveals technology or version details that can assist attackers with fingerprinting and targeted exploitation, increasing the likelihood of tailored attacks against known software weaknesses.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -879,11 +1361,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Configure the web server or reverse proxy to minimize or remove Server header details and avoid exposing version strings in responses.',
     },
     [VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT]: {
-        id: 112,
+        id: 261,
         code: VulnerabilityCode.HEADER_X_POWERED_BY_PRESENT,
         title: 'Information Exposure - X-Powered-By Present',
         description: 'The X-Powered-By header discloses framework or runtime information that can be used to fingerprint the application stack and target known vulnerabilities in specific platforms or versions.',
         severity: 'info',
+        levelId: 5,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -900,11 +1383,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Disable X-Powered-By headers in application frameworks or reverse proxies to reduce stack fingerprinting exposure.',
     },
     [VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED]: {
-        id: 113,
+        id: 262,
         code: VulnerabilityCode.HEADER_X_XSS_PROTECTION_ENABLED,
         title: 'Deprecated Header - X-XSS-Protection Enabled',
         description: 'The X-XSS-Protection header is enabled, which is deprecated and can introduce security risks or inconsistent behavior in legacy browsers due to the removed XSS auditor feature.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -921,11 +1405,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Prefer modern CSP protections and set X-XSS-Protection: 0 or remove the header to avoid relying on deprecated behavior.',
     },
     [VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE]: {
-        id: 114,
+        id: 263,
         code: VulnerabilityCode.COOKIE_SAMESITE_NONE_WITHOUT_SECURE,
         title: 'Cookie Misconfiguration - SameSite=None Without Secure',
         description: 'A cookie is configured with SameSite=None but lacks the Secure attribute, enabling cross-site transmission over unencrypted connections and undermining cookie integrity and confidentiality controls.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -942,11 +1427,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set Secure when SameSite=None is used and ensure the application is served exclusively over HTTPS.',
     },
     [VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE]: {
-        id: 115,
+        id: 264,
         code: VulnerabilityCode.COOKIE_SESSION_MISSING_SECURE,
         title: 'Cookie Misconfiguration - Session Cookie Missing Secure',
         description: 'Session or authentication cookies are missing the Secure attribute, allowing them to be transmitted over unencrypted connections and increasing the risk of session hijacking or credential theft.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -963,11 +1449,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply the Secure attribute to all session cookies and enforce HTTPS with HSTS to prevent downgrade to plaintext.',
     },
     [VulnerabilityCode.COOKIE_MISSING_SECURE]: {
-        id: 116,
+        id: 265,
         code: VulnerabilityCode.COOKIE_MISSING_SECURE,
         title: 'Cookie Misconfiguration - Missing Secure Attribute',
         description: 'Cookies are set without the Secure attribute, permitting transmission over plaintext HTTP and exposing cookie contents to network interception or manipulation.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -984,11 +1471,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set the Secure attribute on cookies that should only be transmitted over HTTPS.',
     },
     [VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY]: {
-        id: 117,
+        id: 266,
         code: VulnerabilityCode.COOKIE_SESSION_MISSING_HTTPONLY,
         title: 'Cookie Misconfiguration - Session Cookie Missing HttpOnly',
         description: 'Session or authentication cookies are missing the HttpOnly attribute, allowing client-side scripts to access sensitive cookie values and increasing the impact of XSS attacks.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1005,11 +1493,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set HttpOnly on session cookies to reduce access from client-side scripts and pair with CSP to mitigate XSS risk.',
     },
     [VulnerabilityCode.COOKIE_MISSING_HTTPONLY]: {
-        id: 118,
+        id: 267,
         code: VulnerabilityCode.COOKIE_MISSING_HTTPONLY,
         title: 'Cookie Misconfiguration - Missing HttpOnly Attribute',
         description: 'Cookies are missing the HttpOnly attribute, allowing JavaScript access to cookie values and increasing the potential impact of client-side script injection.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1026,11 +1515,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Add HttpOnly to cookies that should not be accessed by JavaScript to reduce the impact of XSS.',
     },
     [VulnerabilityCode.COOKIE_MISSING_SAMESITE]: {
-        id: 119,
+        id: 268,
         code: VulnerabilityCode.COOKIE_MISSING_SAMESITE,
         title: 'Cookie Misconfiguration - Missing SameSite Attribute',
         description: 'Cookies do not specify SameSite, which can allow cross-site requests to include cookies by default and increase exposure to CSRF-style attacks or cross-site leakage.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1047,11 +1537,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set SameSite=Lax for general cookies or SameSite=Strict where appropriate to reduce cross-site cookie inclusion.',
     },
     [VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID]: {
-        id: 120,
+        id: 269,
         code: VulnerabilityCode.COOKIE_HOST_PREFIX_INVALID,
         title: 'Cookie Misconfiguration - __Host- Prefix Violations',
         description: 'Cookies with the __Host- prefix do not meet required attributes (Secure, Path=/, no Domain), weakening the protections provided by host-only cookie semantics.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1068,11 +1559,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Ensure __Host- cookies include Secure, Path=/, and omit the Domain attribute to preserve host-only guarantees.',
     },
     [VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID]: {
-        id: 121,
+        id: 270,
         code: VulnerabilityCode.COOKIE_SECURE_PREFIX_INVALID,
         title: 'Cookie Misconfiguration - __Secure- Prefix Violations',
         description: 'Cookies with the __Secure- prefix are missing the Secure attribute, which defeats the prefix requirement and weakens transport security protections.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1089,11 +1581,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set the Secure attribute for all __Secure- cookies and ensure HTTPS is enforced across the application.',
     },
     [VulnerabilityCode.HEADER_DRIFT_CSP]: {
-        id: 122,
+        id: 271,
         code: VulnerabilityCode.HEADER_DRIFT_CSP,
         title: 'Header Drift - Content-Security-Policy Inconsistent',
         description: 'Content-Security-Policy is present on some paths but missing on others, creating uneven defenses and potentially exposing unprotected routes to script injection or content loading risks.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1110,11 +1603,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply CSP consistently across relevant responses, including error and authentication pages, to avoid gaps in policy coverage.',
     },
     [VulnerabilityCode.HEADER_DRIFT_HSTS]: {
-        id: 123,
+        id: 272,
         code: VulnerabilityCode.HEADER_DRIFT_HSTS,
         title: 'Header Drift - Strict-Transport-Security Inconsistent',
         description: 'Strict-Transport-Security is present on some paths but missing on others, reducing the effectiveness of HTTPS enforcement and creating mixed transport behavior across the site.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1131,11 +1625,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Ensure HSTS is set uniformly on HTTPS responses so the browser can enforce strict transport for the entire origin.',
     },
     [VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE]: {
-        id: 124,
+        id: 273,
         code: VulnerabilityCode.HEADER_DRIFT_XCONTENT_TYPE,
         title: 'Header Drift - X-Content-Type-Options Inconsistent',
         description: 'X-Content-Type-Options is present on some paths but missing on others, allowing inconsistent MIME sniffing behavior that could expose unprotected routes to content-type confusion.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1152,11 +1647,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply X-Content-Type-Options: nosniff across all relevant responses to avoid inconsistent browser behavior.',
     },
     [VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY]: {
-        id: 125,
+        id: 274,
         code: VulnerabilityCode.HEADER_DRIFT_REFERRER_POLICY,
         title: 'Header Drift - Referrer-Policy Inconsistent',
         description: 'Referrer-Policy is present on some paths but missing on others, leading to inconsistent referrer leakage controls and potential exposure of sensitive URL data.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1173,11 +1669,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Set a consistent Referrer-Policy across responses to standardize referrer leakage controls.',
     },
     [VulnerabilityCode.HEADER_DRIFT_XFRAME]: {
-        id: 126,
+        id: 275,
         code: VulnerabilityCode.HEADER_DRIFT_XFRAME,
         title: 'Header Drift - X-Frame-Options Inconsistent',
         description: 'X-Frame-Options or equivalent framing controls are present on some paths but missing on others, creating uneven clickjacking protection across the site.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1194,11 +1691,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply X-Frame-Options or CSP frame-ancestors consistently to avoid unprotected pages.',
     },
     [VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY]: {
-        id: 127,
+        id: 276,
         code: VulnerabilityCode.HEADER_DRIFT_PERMISSIONS_POLICY,
         title: 'Header Drift - Permissions-Policy Inconsistent',
         description: 'Permissions-Policy is present on some paths but missing on others, leading to inconsistent controls over browser features such as geolocation, camera, or microphone.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1215,11 +1713,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply Permissions-Policy consistently for pages that should restrict access to sensitive browser features.',
     },
     [VulnerabilityCode.HEADER_DRIFT_COOP]: {
-        id: 128,
+        id: 277,
         code: VulnerabilityCode.HEADER_DRIFT_COOP,
         title: 'Header Drift - COOP Inconsistent',
         description: 'Cross-Origin-Opener-Policy is present on some paths but missing on others, which can lead to uneven cross-origin isolation guarantees and inconsistent window isolation behavior.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1236,11 +1735,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply COOP consistently where cross-origin isolation is required and validate the policy across all relevant routes.',
     },
     [VulnerabilityCode.HEADER_DRIFT_COEP]: {
-        id: 129,
+        id: 278,
         code: VulnerabilityCode.HEADER_DRIFT_COEP,
         title: 'Header Drift - COEP Inconsistent',
         description: 'Cross-Origin-Embedder-Policy is present on some paths but missing on others, resulting in inconsistent embedding restrictions and cross-origin isolation posture.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {
@@ -1257,11 +1757,12 @@ export const CONFIG_VULNERABILITIES = {
         remediation: 'Apply COEP consistently on routes that are intended to enforce cross-origin embedding controls.',
     },
     [VulnerabilityCode.HEADER_DRIFT_CORP]: {
-        id: 130,
+        id: 279,
         code: VulnerabilityCode.HEADER_DRIFT_CORP,
         title: 'Header Drift - CORP Inconsistent',
         description: 'Cross-Origin-Resource-Policy is present on some paths but missing on others, which can leave inconsistent controls on resource sharing and embedding across the application.',
         severity: 'low',
+        levelId: 4,
         category: 'configuration',
         scanner: 'security-headers',
         cvss: {