test: add 15 C++ security scanner fixtures

docs/VULNERABILITY_CATALOG.md

@@ -7,11 +7,11 @@ from each file's header comment, so this page cannot drift from the source.
 
 ## Totals
 
-- **Test cases:** 218
-- **Expected detections:** 218
-- **`VULNERABLE:` markers:** 330 (individual lines a scanner should flag)
-- **`SAFE:` markers:** 235 (lines a scanner must not flag — the false-positive control group)
-- **Languages:** 11 — c, dotenv, go, java, javascript, json, python, ruby, rust, swift, text
+- **Test cases:** 233
+- **Expected detections:** 233
+- **`VULNERABLE:` markers:** 345 (individual lines a scanner should flag)
+- **`SAFE:` markers:** 250 (lines a scanner must not flag — the false-positive control group)
+- **Languages:** 12 — c, cpp, dotenv, go, java, javascript, json, python, ruby, rust, swift, text
 - **CWE categories:** 101 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-95, CWE-113, CWE-117, CWE-121, CWE-129, CWE-134, CWE-187, CWE-190, CWE-201, CWE-203, CWE-208, CWE-209, CWE-256, CWE-285, CWE-287, CWE-288, CWE-291, CWE-295, CWE-297, CWE-306, CWE-307, CWE-311, CWE-312, CWE-319, CWE-321, CWE-326, CWE-327, CWE-328, CWE-329, CWE-330, CWE-338, CWE-345, CWE-346, CWE-347, CWE-352, CWE-362, CWE-367, CWE-377, CWE-384, CWE-400, CWE-409, CWE-415, CWE-416, CWE-434, CWE-441, CWE-457, CWE-460, CWE-472, CWE-475, CWE-476, CWE-480, CWE-488, CWE-489, CWE-502, CWE-506, CWE-509, CWE-512, CWE-521, CWE-522, CWE-525, CWE-532, CWE-598, CWE-601, CWE-602, CWE-611, CWE-613, CWE-614, CWE-620, CWE-639, CWE-640, CWE-643, CWE-681, CWE-693, CWE-732, CWE-759, CWE-776, CWE-789, CWE-798, CWE-835, CWE-862, CWE-863, CWE-915, CWE-916, CWE-918, CWE-922, CWE-942, CWE-943, CWE-1004, CWE-1021, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357
 
 ## How coverage is scored
@@ -42,6 +42,26 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
 | Uninitialized stack bytes copied into a response | [`uninitialized-memory-exposure.c`](../vulns/c/uninitialized-memory-exposure.c) | CWE-457 | high | yes | 1 vuln / 1 safe |
 | Heap object used after it is freed | [`use-after-free.c`](../vulns/c/use-after-free.c) | CWE-416 | critical | yes | 1 vuln / 1 safe |
 
+## Cpp
+
+| Test case | File | CWE | Severity | Expected | Markers |
+|---|---|---|---|---|---|
+| Command injection through std::system | [`command-injection-system.cpp`](../vulns/cpp/command-injection-system.cpp) | CWE-78 | critical | yes | 1 vuln / 1 safe |
+| Dangling string_view returned from local storage | [`dangling-string-view.cpp`](../vulns/cpp/dangling-string-view.cpp) | CWE-416 | high | yes | 1 vuln / 1 safe |
+| Data race on a shared request counter | [`data-race-counter.cpp`](../vulns/cpp/data-race-counter.cpp) | CWE-362 | high | yes | 1 vuln / 1 safe |
+| Heap allocation deleted twice | [`double-delete.cpp`](../vulns/cpp/double-delete.cpp) | CWE-415 | critical | yes | 1 vuln / 1 safe |
+| Authorization failure defaults to allow | [`fail-open-authorization.cpp`](../vulns/cpp/fail-open-authorization.cpp) | CWE-285 | critical | yes | 1 vuln / 1 safe |
+| Uncontrolled format string passed to printf | [`format-string-printf.cpp`](../vulns/cpp/format-string-printf.cpp) | CWE-134 | high | yes | 1 vuln / 1 safe |
+| Hard-coded encryption key embedded in source | [`hardcoded-crypto-key.cpp`](../vulns/cpp/hardcoded-crypto-key.cpp) | CWE-321 | high | yes | 1 vuln / 1 safe |
+| Security-sensitive length truncated to a smaller integer | [`integer-truncation.cpp`](../vulns/cpp/integer-truncation.cpp) | CWE-681 | high | yes | 1 vuln / 1 safe |
+| Iterator dereferenced after vector reallocation | [`invalidated-vector-iterator.cpp`](../vulns/cpp/invalidated-vector-iterator.cpp) | CWE-416 | high | yes | 1 vuln / 1 safe |
+| Authentication bypass through prefix comparison | [`partial-api-key-comparison.cpp`](../vulns/cpp/partial-api-key-comparison.cpp) | CWE-187 | critical | yes | 1 vuln / 1 safe |
+| Path traversal through an untrusted child path | [`path-traversal-filesystem.cpp`](../vulns/cpp/path-traversal-filesystem.cpp) | CWE-22 | high | yes | 1 vuln / 1 safe |
+| Predictable recovery token generated with mt19937 | [`predictable-reset-token.cpp`](../vulns/cpp/predictable-reset-token.cpp) | CWE-330 | high | yes | 1 vuln / 1 safe |
+| SQL injection through string concatenation | [`sql-injection-concat.cpp`](../vulns/cpp/sql-injection-concat.cpp) | CWE-89 | critical | yes | 1 vuln / 1 safe |
+| Unbounded allocation from a request-controlled count | [`unbounded-vector-allocation.cpp`](../vulns/cpp/unbounded-vector-allocation.cpp) | CWE-789 | high | yes | 1 vuln / 1 safe |
+| Out-of-bounds vector access through an unvalidated index | [`vector-out-of-bounds.cpp`](../vulns/cpp/vector-out-of-bounds.cpp) | CWE-129 | high | yes | 1 vuln / 1 safe |
+
 ## Go
 
 | Test case | File | CWE | Severity | Expected | Markers |