@zhuma4/cli 4.0.0-alpha.1 → 4.3.0

package/rules/nvd-generated/cwe_22/cl-22-python-071.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-22-22-python-071.yaml
+# Generated: 2026-06-28T10:37:40.258Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-22-PYTHON-071 | CWE: CWE-22 | Lang: python
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 3507 | KEV: 25 | Exploit: 116
+
+rules:
+- id: zhuma-nvd-22-22-python-071
+  metadata:
+    category: A01:2021-Broken Access Control
+    cwe: "CWE-22: Path Traversal"
+    cve: "CVE-2019-16278, CVE-2019-5418, CVE-2024-32113, CVE-2024-23897, CVE-2021-41277, CVE-2021-20124, CVE-2021-20123, CVE-2026-34909"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-16278
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-5418
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-32113
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-23897
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-41277
+      - https://cwe.mitre.org/data/definitions/22.html
+
+  message: |
+    检测到路径遍历风险。用户输入被用于文件路径构造，可能访问任意文件。
+        修复: 对用户输入做路径规范化和白名单校验，禁止..和绝对路径。
+
+  severity: WARNING
+  languages:
+    - python
+
+  patterns:
+  - pattern: send_from_directory(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-22-PYTHON-071
+  # cwe: CWE-22 | language: python
+  # sink_patterns: [object Object]
+  # wooyun_cases: 7 | tier: N/A

package/rules/nvd-generated/cwe_22/cl-22-python-072.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-22-22-python-072.yaml
+# Generated: 2026-06-28T10:37:40.258Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-22-PYTHON-072 | CWE: CWE-22 | Lang: python
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 3507 | KEV: 25 | Exploit: 116
+
+rules:
+- id: zhuma-nvd-22-22-python-072
+  metadata:
+    category: A01:2021-Broken Access Control
+    cwe: "CWE-22: Path Traversal"
+    cve: "CVE-2019-16278, CVE-2019-5418, CVE-2024-32113, CVE-2024-23897, CVE-2021-41277, CVE-2021-20124, CVE-2021-20123, CVE-2026-34909"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-16278
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-5418
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-32113
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-23897
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-41277
+      - https://cwe.mitre.org/data/definitions/22.html
+
+  message: |
+    检测到路径遍历风险。用户输入被用于文件路径构造，可能访问任意文件。
+        修复: 对用户输入做路径规范化和白名单校验，禁止..和绝对路径。
+
+  severity: WARNING
+  languages:
+    - python
+
+  patterns:
+  - pattern: FileResponse(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-22-PYTHON-072
+  # cwe: CWE-22 | language: python
+  # sink_patterns: [object Object]
+  # wooyun_cases: 7 | tier: N/A

package/rules/nvd-generated/cwe_22/cl-22-python-073.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-22-22-python-073.yaml
+# Generated: 2026-06-28T10:37:40.258Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-22-PYTHON-073 | CWE: CWE-22 | Lang: python
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 3507 | KEV: 25 | Exploit: 116
+
+rules:
+- id: zhuma-nvd-22-22-python-073
+  metadata:
+    category: A01:2021-Broken Access Control
+    cwe: "CWE-22: Path Traversal"
+    cve: "CVE-2019-16278, CVE-2019-5418, CVE-2024-32113, CVE-2024-23897, CVE-2021-41277, CVE-2021-20124, CVE-2021-20123, CVE-2026-34909"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-16278
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-5418
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-32113
+      - https://nvd.nist.gov/vuln/detail/CVE-2024-23897
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-41277
+      - https://cwe.mitre.org/data/definitions/22.html
+
+  message: |
+    检测到路径遍历风险。用户输入被用于文件路径构造，可能访问任意文件。
+        修复: 对用户输入做路径规范化和白名单校验，禁止..和绝对路径。
+
+  severity: WARNING
+  languages:
+    - python
+
+  patterns:
+  - pattern: $OBJ.extractall(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-22-PYTHON-073
+  # cwe: CWE-22 | language: python
+  # sink_patterns: [object Object]
+  # wooyun_cases: 7 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-go-187.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-go-187.yaml
+# Generated: 2026-06-28T10:37:40.289Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-GO-187 | CWE: CWE-287 | Lang: go
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-go-187
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - go
+
+  patterns:
+  - pattern-regex: 'jwt.Parse|jwt.ParseWithClaims'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-GO-187
+  # cwe: CWE-287 | language: go
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-go-188.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-go-188.yaml
+# Generated: 2026-06-28T10:37:40.289Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-GO-188 | CWE: CWE-287 | Lang: go
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-go-188
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - go
+
+  patterns:
+  - pattern: $OBJ.BasicAuth(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-GO-188
+  # cwe: CWE-287 | language: go
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-java-180.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-java-180.yaml
+# Generated: 2026-06-28T10:37:40.286Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-JAVA-180 | CWE: CWE-287 | Lang: java
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-java-180
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - java
+
+  patterns:
+  - pattern-regex: 'RememberMeAuthenticationToken|rememberMeServices'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-JAVA-180
+  # cwe: CWE-287 | language: java
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-java-181.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-java-181.yaml
+# Generated: 2026-06-28T10:37:40.287Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-JAVA-181 | CWE: CWE-287 | Lang: java
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-java-181
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - java
+
+  patterns:
+  - pattern-regex: 'Jwts.parser\(\).parseClaimsJws'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-JAVA-181
+  # cwe: CWE-287 | language: java
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-java-182.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-java-182.yaml
+# Generated: 2026-06-28T10:37:40.287Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-JAVA-182 | CWE: CWE-287 | Lang: java
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-java-182
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - java
+
+  patterns:
+  - pattern-regex: 'permitAll\(\)'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-JAVA-182
+  # cwe: CWE-287 | language: java
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-javascript-183.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-javascript-183.yaml
+# Generated: 2026-06-28T10:37:40.288Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-JAVASCRIPT-183 | CWE: CWE-287 | Lang: javascript
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-javascript-183
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - javascript
+
+  patterns:
+  - pattern-regex: 'jwt.decode \(no verify\)'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-JAVASCRIPT-183
+  # cwe: CWE-287 | language: javascript
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-javascript-184.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-javascript-184.yaml
+# Generated: 2026-06-28T10:37:40.288Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-JAVASCRIPT-184 | CWE: CWE-287 | Lang: javascript
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-javascript-184
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - javascript
+
+  patterns:
+  - pattern: $OBJ.authenticate(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-JAVASCRIPT-184
+  # cwe: CWE-287 | language: javascript
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-python-185.yaml

@@ -0,0 +1,44 @@
+# zhuma-nvd-287-287-python-185.yaml
+# Generated: 2026-06-28T10:37:40.288Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-PYTHON-185 | CWE: CWE-287 | Lang: python
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-python-185
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - python
+
+  patterns:
+  - pattern-regex: '@app.route \(no @login_required\)'
+  # CONSTRAINT: pattern-not: whitelist known-public paths (/login, /register, /health, /static)
+  # CONSTRAINT: Reduce severity to INFO — public endpoints may be intentional
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-PYTHON-185
+  # cwe: CWE-287 | language: python
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_287/cl-287-python-186.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-287-287-python-186.yaml
+# Generated: 2026-06-28T10:37:40.288Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-287-PYTHON-186 | CWE: CWE-287 | Lang: python
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 1683 | KEV: 12 | Exploit: 33
+
+rules:
+- id: zhuma-nvd-287-287-python-186
+  metadata:
+    category: A07:2021-Identification and Authentication Failures
+    cwe: "CWE-287: Improper Authentication"
+    cve: "CVE-2021-33045, CVE-2021-33044, CVE-2021-32030, CVE-2019-19006, CVE-2025-32975, CVE-2025-61882, CVE-2024-7593, CVE-2023-28461"
+    likelihood: HIGH
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33045
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-33044
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
+      - https://nvd.nist.gov/vuln/detail/CVE-2019-19006
+      - https://nvd.nist.gov/vuln/detail/CVE-2025-32975
+      - https://cwe.mitre.org/data/definitions/287.html
+
+  message: |
+    检测到认证绕过风险。身份验证逻辑存在缺陷。
+        修复: 确保关键操作前完成身份验证，使用框架认证中间件。
+
+  severity: WARNING
+  languages:
+    - python
+
+  patterns:
+  - pattern: rest_framework_jwt(...)
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-287-PYTHON-186
+  # cwe: CWE-287 | language: python
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_327/cl-327-go-169.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-327-327-go-169.yaml
+# Generated: 2026-06-28T10:37:40.306Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-327-GO-169 | CWE: CWE-327 | Lang: go
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 204 | KEV: 0 | Exploit: 1
+
+rules:
+- id: zhuma-nvd-327-327-go-169
+  metadata:
+    category: A02:2021-Cryptographic Failures
+    cwe: "CWE-327: Weak Cryptography"
+    cve: "CVE-2022-35513, CVE-2021-45696, CVE-2020-36363, CVE-2021-22738, CVE-2020-14517, CVE-2020-3681, CVE-2019-13022, CVE-2020-10377"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2022-35513
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-45696
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36363
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-22738
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-14517
+      - https://cwe.mitre.org/data/definitions/327.html
+
+  message: |
+    检测到弱加密算法风险。使用了已知不安全的加密算法/哈希函数。
+        修复: 使用AES-GCM/ChaCha20替代DES/RC4，使用SHA-256/Argon2替代MD5/SHA-1。
+
+  severity: WARNING
+  languages:
+    - go
+
+  patterns:
+  - pattern-regex: 'md5.New|md5.Sum'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-327-GO-169
+  # cwe: CWE-327 | language: go
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_327/cl-327-go-170.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-327-327-go-170.yaml
+# Generated: 2026-06-28T10:37:40.306Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-327-GO-170 | CWE: CWE-327 | Lang: go
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 204 | KEV: 0 | Exploit: 1
+
+rules:
+- id: zhuma-nvd-327-327-go-170
+  metadata:
+    category: A02:2021-Cryptographic Failures
+    cwe: "CWE-327: Weak Cryptography"
+    cve: "CVE-2022-35513, CVE-2021-45696, CVE-2020-36363, CVE-2021-22738, CVE-2020-14517, CVE-2020-3681, CVE-2019-13022, CVE-2020-10377"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2022-35513
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-45696
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36363
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-22738
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-14517
+      - https://cwe.mitre.org/data/definitions/327.html
+
+  message: |
+    检测到弱加密算法风险。使用了已知不安全的加密算法/哈希函数。
+        修复: 使用AES-GCM/ChaCha20替代DES/RC4，使用SHA-256/Argon2替代MD5/SHA-1。
+
+  severity: WARNING
+  languages:
+    - go
+
+  patterns:
+  - pattern-regex: 'rand.Int|rand.Intn'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-327-GO-170
+  # cwe: CWE-327 | language: go
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A

package/rules/nvd-generated/cwe_327/cl-327-java-161.yaml

@@ -0,0 +1,43 @@
+# zhuma-nvd-327-327-java-161.yaml
+# Generated: 2026-06-28T10:37:40.303Z
+# Source: P2 auto-generation (fixed) from P1.5 classified clusters
+# Cluster: CL-327-JAVA-161 | CWE: CWE-327 | Lang: java
+# Precision: MEDIUM | Noise: MEDIUM
+# CVEs: 204 | KEV: 0 | Exploit: 1
+
+rules:
+- id: zhuma-nvd-327-327-java-161
+  metadata:
+    category: A02:2021-Cryptographic Failures
+    cwe: "CWE-327: Weak Cryptography"
+    cve: "CVE-2022-35513, CVE-2021-45696, CVE-2020-36363, CVE-2021-22738, CVE-2020-14517, CVE-2020-3681, CVE-2019-13022, CVE-2020-10377"
+    likelihood: MEDIUM
+    precision: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    source: nvd+wooyun
+    references:
+      - https://nvd.nist.gov/vuln/detail/CVE-2022-35513
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-45696
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-36363
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-22738
+      - https://nvd.nist.gov/vuln/detail/CVE-2020-14517
+      - https://cwe.mitre.org/data/definitions/327.html
+
+  message: |
+    检测到弱加密算法风险。使用了已知不安全的加密算法/哈希函数。
+        修复: 使用AES-GCM/ChaCha20替代DES/RC4，使用SHA-256/Argon2替代MD5/SHA-1。
+
+  severity: WARNING
+  languages:
+    - java
+
+  patterns:
+  - pattern-regex: 'MessageDigest.getInstance\("MD5"|"SHA-1"|"SHA1"\)'
+  # CONSTRAINT: pattern: verify sink is in security-sensitive context
+
+  # --- P2 METADATA ---
+  # cluster_id: CL-327-JAVA-161
+  # cwe: CWE-327 | language: java
+  # sink_patterns: [object Object]
+  # wooyun_cases: 0 | tier: N/A