All issues

False positive

#22280

· demesewdajen857-a11y opened

on Aug 4, 2026

Java: Should these sanitizer heuristics completely stop taint in five security queries?

#22262

· wildoranges opened

on Jul 31, 2026

java/ssrf: allowlist guard not recognized when expressed via Stream/lambda (anyMatch), only via plain equals()/for-loop

#22259

· richard-alun-williams opened

on Jul 30, 2026

Java: PQC API misuse queries for experimental/quantum - wanted, and against which layer?

#22253

· Arpan0995 opened

on Jul 29, 2026

Arguments to macro calls to `format` and `print` are not registered as data-flow nodes

#22244

· jeongsoolee09 opened

on Jul 28, 2026

False positive: "Missing cross-site request forgery token validation" does not recognize [RequireAntiforgeryToken]

#22238

· daiplusplus opened

on Jul 27, 2026

Consider testing CodeQL also against Kotlin EA versions

#22219

· scordio opened

on Jul 21, 2026

False positive: "Missing cross-site request forgery token validation" should not apply to Web API Controller Actions sharing a project with Browser-based actions

#22215

· daiplusplus opened

on Jul 21, 2026

Go: Why is DotDotCheck modeled as a complete path-injection barrier?

#22214

· wildoranges opened

on Jul 20, 2026

[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

#22213

· 1sgtpepper opened

on Jul 19, 2026

False positive Java. SpringBoot CSRF

#22199

· rcollette opened

on Jul 15, 2026

[C#] False positive in cs/simplifiable-boolean-expression for operator != implementation

#22190

· christiannagel opened

on Jul 14, 2026