ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

CVE-2026-45367 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches, matchesFull, and replaceMatches to Java regex operations without effective timeouts,...

CVE-2026-45367

creationtimestamp| type| source ---|---|--- 2026-07-08 23:00:13+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mq67w72ugf2l...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

The fix for CVE-2026-45367 added RegexTimeout protection to the matches function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In org.hl7.fhir.dstu2, replaceMatches was updated while matches at line 2462 still calls the raw String.matchessw without any...

CVE-2023-45367

An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use a rest.php/checkuser/v0/useragent-clienthints/revision/ URL to store an arbitrary number of rows in cuuseragentclienthints, leading to a...

CVE-2024-45367

creationtimestamp| type| source ---|---|--- 2024-10-04 01:49:09+00:00| seen| https://t.me/cvedetector/6940...

CVE-2024-45367 Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication

The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password...

Optigo Networks ONS-S8 - Spectra Aggregation Switch

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion', Weak...

CVE-2023-45367

creationtimestamp| type| source ---|---|--- 2023-10-09 12:15:43+00:00| seen| https://t.me/cibsecurity/71801...

CVE-2023-45367

The CVE-2023-45367 issue affects the MediaWiki CheckUser extension (versions before 1.35.12; 1.36.x–1.39.x before 1.39.5; 1.40.x before 1.40.1). A remote attacker can access rest.php/checkuser/v0/useragent-clienthints/revision/ to store an arbitrary number of rows in cu_useragent_clienthints, cau...

CVE-2022-45367 WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin = 1.4.0 versions...

CVE-2022-45367

CVE-2022-45367: A CSRF vulnerability in the Tyche Softwares Custom Order Numbers for WooCommerce plugin (

CVE-2022-45367 WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin = 1.4.0 versions...

WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Order Numbers for WooCommerce Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-45367 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a36c311d72e2 Credit...