Posture
critical
1
high
11
medium
5
low
5
Ownership
Findings (25)
low
Path traversal in file download endpoint
Scout SuiteCSPM
accepted
8.4
high
Terraform module pins old AMI with CVEs
Burp Pro PenTestPenTest
open
7.4
high
Missing rate limiting on /login
SonarQubeSAST
false positive
8.8
medium
JWT signed with weak HS256 secret
SemgrepSAST
triaged
9.1
high
Race condition in payment idempotency
Cloudflare WAFWAF
open
8.5
low
Excessive Kubernetes RBAC privileges
SemgrepSAST
triaged
4.5
low
Cross-site Scripting in profile renderer
Contrast RASPRASP
open
5.1
medium
Path traversal in file download endpoint
OWASP ZAPDAST
open
5
high
Excessive Kubernetes RBAC privileges
CheckmarxSAST
false positive
6.4
low
Dependency confusion risk on internal package
DependabotSCA
triaged
8.9
critical
Missing rate limiting on /login
Burp SuiteDAST
open
8.1
info
Race condition in payment idempotency
Scout SuiteCSPM
false positive
6.2
high
Container running as root
GitleaksSecrets
open
6.8
info
Missing rate limiting on /login
Scout SuiteCSPM
open
9.6
high
Log4Shell vulnerable dependency
SonarQubeSAST
triaged
6.6
high
Outdated lodash with prototype pollution
CodeQLSAST
open
7.1
high
Missing CSP header on auth pages
GrypeContainer
false positive
6.7
high
Log4Shell vulnerable dependency
tfsecIaC
accepted
5.1
high
SQL Injection in user-input handler
SnykSCA
triaged
9.7
medium
SSRF in webhook fetcher
Burp Pro PenTestPenTest
triaged
8.1
info
Terraform module pins old AMI with CVEs
Burp Pro PenTestPenTest
triaged
5.9
low
Race condition in payment idempotency
CodeQLSAST
triaged
9
medium
Insecure deserialization in message queue consumer
TrivyContainer
open
9.4