CVE-2026-73425 | Low | 3.7 | 2026-08-12 | Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular express… |
CVE-2026-64655 | | | 2026-08-06 | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from th… |
CVE-2026-45065 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator val… |
CVE-2026-56021 | Medium | 5.3 | 2026-06-18 | Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern. |
CVE-2026-47674 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) com… |
CVE-2026-48147 | Medium | 6.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t… |
CVE-2026-4296 | High | 8.8 | 2026-04-21 | An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An a… |
CVE-2026-25542 | Medium | 6.5 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2… |
CVE-2026-39350 | Medium | 5.4 | 2026-04-15 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the servi… |
CVE-2026-33347 | Medium | 6.1 | 2026-03-24 | league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a… |
CVE-2026-33418 | High | 7.5 | 2026-03-24 | DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based app… |
CVE-2026-27895 | Medium | 4.3 | 2026-03-18 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF… |
CVE-2026-3419 | Medium | 5.3 | 2026-03-06 | Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://ht… |
CVE-2026-25896 | Critical | 9.3 | 2026-02-20 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to b… |
CVE-2026-25479 | Medium | 6.5 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled in… |
CVE-2026-24398 | Medium | 4.8 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable… |
CVE-2025-54365 | High | 7.5 | 2025-07-23 | fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1… |
CVE-2025-20139 | High | 7.5 | 2025-04-02 | A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic… |
CVE-2024-52289 | Critical | 9.8 | 2024-11-21 | authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison.
When no Redirect URIs are con… |
CVE-2024-6641 | Medium | 5.3 | 2024-09-18 | The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This… |
CVE-2024-2223 | High | 8.1 | 2024-04-09 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur… |
CVE-2021-36093 | Medium | 5.3 | 2021-09-06 | It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Ed… |
CVE-2018-1109 | Medium | 5.3 | 2021-03-30 | A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of… |
CVE-2020-7929 | Medium | 6.5 | 2021-03-01 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong… |
CVE-2020-3408 | High | 8.6 | 2020-09-24 | A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d… |
CVE-2020-7016 | Medium | 4.8 | 2020-07-27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c… |
CVE-2020-11034 | Medium | 6.1 | 2020-05-05 | In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in ve… |
CVE-2020-1741 | Medium | 5.9 | 2020-04-24 | A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installati… |
CVE-2019-14993 | High | 7.5 | 2019-08-13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService… |
CVE-2019-12798 | Critical | 9.8 | 2019-06-13 | An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syn… |
CVE-2018-20801 | High | 7.5 | 2019-03-14 | In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service atta… |
CVE-2018-20164 | Medium | 5.3 | 2019-02-13 | An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote… |
CVE-2018-17984 | High | 7.8 | 2018-10-04 | An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit… |
CVE-2018-11615 | High | 7.5 | 2018-08-30 | This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne… |
CVE-2018-3738 | Medium | 5.5 | 2018-06-07 | protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. |
CVE-2018-3737 | High | 7.5 | 2018-06-07 | sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. |
CVE-2018-7158 | High | 7.5 | 2018-05-17 | The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced… |
CVE-2018-7537 | Medium | 5.3 | 2018-03-09 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods we… |
CVE-2018-7536 | Medium | 5.3 | 2018-03-09 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to e… |
CVE-2015-8389 | Critical | 9.8 | 2015-12-02 | PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) o… |
CVE-2015-8388 | | | 2015-12-02 | PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to… |