CVE-2026-104150 | | | 2026-10-15 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.mat… |
CVE-2026-108082 | | | 2026-10-15 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUt… |
CVE-2026-110869 | High | 7.5 | 2026-10-14 | Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain o… |
CVE-2026-110856 | High | 7.5 | 2026-10-14 | GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, com… |
CVE-2026-110594 | Medium | 4.9 | 2026-10-14 | BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web… |
CVE-2026-109563 | High | 7.5 | 2026-10-12 | N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit run… |
CVE-2026-109295 | Medium | 6.5 | 2026-10-12 | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via… |
CVE-2026-104628 | Medium | 6.5 | 2026-10-08 | Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges c… |
CVE-2026-107290 | Medium | 6.5 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_t… |
CVE-2026-107572 | Medium | 6.5 | 2026-10-08 | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the… |
CVE-2026-106454 | Medium | 4.3 | 2026-10-06 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py trans… |
CVE-2026-102408 | Medium | 4.3 | 2026-10-06 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The… |
CVE-2026-106104 | | | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent reque… |
CVE-2026-105854 | High | 7.5 | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malfor… |
CVE-2026-105646 | Medium | 4.9 | 2026-10-05 | Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server u… |
CVE-2026-105645 | Medium | 4.9 | 2026-10-05 | Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making… |
CVE-2026-105219 | High | 7.5 | 2026-10-04 | Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due t… |
CVE-2026-104861 | High | 7.5 | 2026-10-02 | probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching… |
CVE-2026-67989 | High | 7.5 | 2026-10-02 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model ca… |
CVE-2026-96292 | | | 2026-10-02 | Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift… |
CVE-2026-104454 | Medium | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated atta… |
CVE-2026-77387 | Medium | 4.0 | 2026-10-01 | geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression… |
CVE-2026-102990 | | | 2026-09-30 | basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsin… |
CVE-2026-100267 | Medium | 5.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
CVE-2026-103043 | High | 7.5 | 2026-09-29 | anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attack… |
CVE-2026-67987 | High | 7.5 | 2026-09-29 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag respons… |
CVE-2026-102473 | Medium | 5.5 | 2026-09-29 | A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local… |
CVE-2026-102270 | Medium | 4.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks e… |
CVE-2026-101906 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular ex… |
CVE-2026-101903 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sid… |
CVE-2026-67419 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecut… |
CVE-2026-67413 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic… |
CVE-2026-87722 | | | 2026-09-24 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate… |
CVE-2026-54461 | Medium | 6.5 | 2026-09-24 | Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/… |
CVE-2026-67240 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unic… |
CVE-2026-66074 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regula… |
CVE-2026-77423 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and displa… |
CVE-2026-77422 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/bui… |
CVE-2026-77421 | Medium | 6.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-contro… |
CVE-2026-77420 | Medium | 5.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/sr… |
CVE-2026-89407 | High | 7.5 | 2026-09-22 | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[… |
CVE-2026-58270 | Medium | 6.5 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user… |
CVE-2026-93761 | High | 7.5 | 2026-09-18 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cau… |
CVE-2026-86000 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTI… |
CVE-2026-85999 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw select… |
CVE-2026-63460 | High | 7.5 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically… |
CVE-2026-92599 | High | 7.5 | 2026-09-16 | joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().is… |
CVE-2026-92114 | Medium | 5.3 | 2026-09-15 | A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functio… |
CVE-2026-76821 | | | 2026-09-15 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWi… |
CVE-2026-57577 | | | 2026-09-14 | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained par… |
CVE-2026-82617 | Critical | 9.8 | 2026-09-11 | The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER… |
CVE-2026-68497 | High | 7.5 | 2026-09-11 | jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to Da… |
CVE-2026-75880 | Medium | 6.5 | 2026-09-10 | An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery… |
CVE-2026-87819 | High | 7.5 | 2026-09-09 | GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fiel… |
CVE-2026-86081 | | | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destinat… |
CVE-2026-85062 | | | 2026-09-03 | Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/color… |
CVE-2026-84642 | High | 7.5 | 2026-09-01 | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnam… |
CVE-2026-83619 | | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in… |
CVE-2026-83606 | | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instru… |
CVE-2024-58379 | Medium | 5.3 | 2026-08-31 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embed… |
CVE-2026-55520 | | | 2026-08-28 | Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex tran… |
CVE-2026-80206 | Medium | 5.9 | 2026-08-26 | NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-sup… |
CVE-2026-80205 | High | 7.5 | 2026-08-26 | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user… |
CVE-2026-79770 | High | 7.5 | 2026-08-25 | Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identif… |
CVE-2026-66766 | High | 7.5 | 2026-08-25 | SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacke… |
CVE-2026-70656 | Medium | 4.9 | 2026-08-21 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-72818 | High | 7.5 | 2026-08-20 | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain br… |
CVE-2026-77082 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch… |
CVE-2026-62317 | High | 7.5 | 2026-08-19 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/librarie… |
CVE-2026-62672 | | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::reg… |
CVE-2026-74039 | Medium | 6.5 | 2026-08-18 | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CP… |
CVE-2026-59893 | High | 7.5 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py rep… |
CVE-2026-54284 | | | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten n… |
CVE-2026-58436 | High | 7.5 | 2026-08-13 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
CVE-2026-73556 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend… |
CVE-2026-67991 | High | 7.5 | 2026-08-13 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.u… |
CVE-2026-72912 | Medium | 4.3 | 2026-08-10 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can ex… |
CVE-2026-69207 | Medium | 5.3 | 2026-08-07 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable… |
CVE-2026-66062 | Medium | 5.3 | 2026-08-07 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used b… |
CVE-2026-67422 | High | 7.5 | 2026-08-06 | pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, b… |
CVE-2026-68749 | High | 7.5 | 2026-08-06 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust ser… |
CVE-2026-71190 | | | 2026-08-05 | In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qd… |
CVE-2026-70493 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/op… |
CVE-2026-70489 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_we… |
CVE-2026-23985 | Medium | 6.5 | 2026-07-30 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_pa… |
CVE-2026-60075 | High | 7.5 | 2026-07-30 | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time rem… |
CVE-2026-16270 | | | 2026-07-22 | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the p… |
CVE-2026-49485 | High | 7.5 | 2026-07-17 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHI… |
CVE-2026-52746 | High | 7.5 | 2026-07-17 | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear ba… |
CVE-2026-14741 | High | 7.5 | 2026-07-17 | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.
parse_date() matches the date string against a… |
CVE-2026-62237 | Medium | 6.5 | 2026-07-17 | Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the… |
CVE-2026-45367 | High | 7.5 | 2026-07-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation pass… |
CVE-2026-49477 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular express… |
CVE-2026-48801 | High | 7.5 | 2026-07-14 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) alg… |
CVE-2026-48125 | Medium | 5.3 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expressio… |
CVE-2026-45305 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45133 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser… |
CVE-2026-45756 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath compon… |
CVE-2026-6850 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which a… |
CVE-2026-57584 | | | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route… |