CVE-2026-102990 | | | 2026-09-30 | basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsin… |
CVE-2026-100267 | Medium | 5.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
CVE-2026-103043 | High | 7.5 | 2026-09-29 | anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attack… |
CVE-2026-102473 | Medium | 5.5 | 2026-09-29 | A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local… |
CVE-2026-102270 | Medium | 4.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks e… |
CVE-2026-101906 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular ex… |
CVE-2026-101903 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sid… |
CVE-2026-67419 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecut… |
CVE-2026-67413 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic… |
CVE-2026-87722 | | | 2026-09-24 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate… |
CVE-2026-54461 | Medium | 6.5 | 2026-09-24 | Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/… |
CVE-2026-67240 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unic… |
CVE-2026-66074 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regula… |
CVE-2026-77423 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and displa… |
CVE-2026-77422 | High | 7.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/bui… |
CVE-2026-77421 | Medium | 6.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-contro… |
CVE-2026-77420 | Medium | 5.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/sr… |
CVE-2026-89407 | High | 7.5 | 2026-09-22 | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[… |
CVE-2026-58270 | Medium | 6.5 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user… |
CVE-2026-93761 | High | 7.5 | 2026-09-18 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cau… |
CVE-2026-86000 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTI… |
CVE-2026-85999 | Medium | 5.3 | 2026-09-17 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw select… |
CVE-2026-63460 | High | 7.5 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically… |
CVE-2026-92599 | High | 7.5 | 2026-09-16 | joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().is… |
CVE-2026-92114 | Medium | 5.3 | 2026-09-15 | A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functio… |
CVE-2026-76821 | | | 2026-09-15 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWi… |
CVE-2026-57577 | | | 2026-09-14 | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained par… |
CVE-2026-82617 | Critical | 9.8 | 2026-09-11 | The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER… |
CVE-2026-68497 | High | 7.5 | 2026-09-11 | jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to Da… |
CVE-2026-75880 | Medium | 6.5 | 2026-09-10 | An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery… |
CVE-2026-87819 | High | 7.5 | 2026-09-09 | GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fiel… |
CVE-2026-86081 | | | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destinat… |
CVE-2026-85062 | | | 2026-09-03 | Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/color… |
CVE-2026-84642 | High | 7.5 | 2026-09-01 | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnam… |
CVE-2026-83619 | | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in… |
CVE-2026-83606 | | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instru… |
CVE-2024-58379 | Medium | 5.3 | 2026-08-31 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embed… |
CVE-2026-55520 | | | 2026-08-28 | Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex tran… |
CVE-2026-80206 | Medium | 5.9 | 2026-08-26 | NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-sup… |
CVE-2026-80205 | High | 7.5 | 2026-08-26 | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user… |
CVE-2026-79770 | High | 7.5 | 2026-08-25 | Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identif… |
CVE-2026-66766 | High | 7.5 | 2026-08-25 | SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacke… |
CVE-2026-70656 | Medium | 4.9 | 2026-08-21 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-72818 | High | 7.5 | 2026-08-20 | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain br… |
CVE-2026-77082 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch… |
CVE-2026-62317 | High | 7.5 | 2026-08-19 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/librarie… |
CVE-2026-62672 | | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::reg… |
CVE-2026-74039 | Medium | 6.5 | 2026-08-18 | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CP… |
CVE-2026-59893 | High | 7.5 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py rep… |
CVE-2026-54284 | | | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten n… |
CVE-2026-58436 | High | 7.5 | 2026-08-13 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
CVE-2026-73556 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend… |
CVE-2026-67991 | High | 7.5 | 2026-08-13 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.u… |
CVE-2026-72912 | Medium | 4.3 | 2026-08-10 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can ex… |
CVE-2026-69207 | Medium | 5.3 | 2026-08-07 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable… |
CVE-2026-66062 | Medium | 5.3 | 2026-08-07 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used b… |
CVE-2026-67422 | High | 7.5 | 2026-08-06 | pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, b… |
CVE-2026-68749 | High | 7.5 | 2026-08-06 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust ser… |
CVE-2026-71190 | | | 2026-08-05 | In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qd… |
CVE-2026-70493 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/op… |
CVE-2026-70489 | Medium | 6.5 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_we… |
CVE-2026-23985 | Medium | 6.5 | 2026-07-30 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_pa… |
CVE-2026-60075 | High | 7.5 | 2026-07-30 | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time.
_parse_time rem… |
CVE-2026-16270 | | | 2026-07-22 | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the p… |
CVE-2026-49485 | High | 7.5 | 2026-07-17 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHI… |
CVE-2026-52746 | High | 7.5 | 2026-07-17 | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear ba… |
CVE-2026-14741 | High | 7.5 | 2026-07-17 | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.
parse_date() matches the date string against a… |
CVE-2026-62237 | Medium | 6.5 | 2026-07-17 | Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the… |
CVE-2026-45367 | High | 7.5 | 2026-07-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation pass… |
CVE-2026-49477 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular express… |
CVE-2026-48801 | High | 7.5 | 2026-07-14 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) alg… |
CVE-2026-48125 | Medium | 5.3 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expressio… |
CVE-2026-45305 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45133 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser… |
CVE-2026-45756 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath compon… |
CVE-2026-6850 | Medium | 6.5 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which a… |
CVE-2026-57584 | | | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route… |
CVE-2026-59220 | Medium | 6.5 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expre… |
CVE-2026-55470 | High | 7.5 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incomplete… |
CVE-2026-15154 | Medium | 6.5 | 2026-07-08 | A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), all… |
CVE-2026-59928 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definit… |
CVE-2026-59925 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs… |
CVE-2026-59922 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character ca… |
CVE-2026-14895 | High | 7.5 | 2026-07-07 | String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.
The trim and rtrim functions stripped trailing whitespac… |
CVE-2026-55574 | High | 7.5 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user… |
CVE-2026-58578 | Medium | 6.5 | 2026-07-02 | LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the… |
CVE-2026-52794 | High | 7.5 | 2026-06-24 | Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in S… |
CVE-2026-49851 | High | 7.5 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately… |
CVE-2026-54268 | High | 7.5 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2025-71379 | Medium | 4.3 | 2026-06-20 | vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.p… |
CVE-2026-49293 | High | 7.5 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary intege… |
CVE-2026-45617 | High | 7.5 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a… |
CVE-2026-47138 | | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthen… |
CVE-2026-44496 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regula… |
CVE-2026-42567 | High | 7.5 | 2026-06-09 | Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time… |
CVE-2026-41848 | Low | 3.7 | 2026-06-09 | Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or i… |
CVE-2026-52778 | Critical | 9.8 | 2026-06-08 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of… |
CVE-2026-11478 | Low | 3.3 | 2026-06-08 | A flaw has been found in kokke tiny-regex-c up to f2632c6d9ed25272987471cdb8b70395c2460bdb. This vulnerability affects the function matchstar of the file re.c… |
CVE-2026-45409 | Medium | 5.3 | 2026-06-05 | Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Co… |
CVE-2026-8888 | High | 7.5 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new R… |