Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters

Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2024-4867

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in path-to-regexp

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in path-to-regexp. CVE-2026-4867 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time...

Security Bulletin: There is a vulnerability in path-to-regexp-0.1.12.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-4867)

Summary There is a vulnerability in path-to-regexp-0.1.12.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you have three or more parameters within a single...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the path-to-regexp package

Summary Due to use of the path-to-regexp package, DevOps Test Performance and Rational Performance Tester contain a potential Regular Expression Denial of Service ReDoS vulnerability. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you...

CVE-2024-4867

creationtimestamp| type| source ---|---|--- 2026-04-16 14:16:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmlx47bla2q...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, sqlpad, kubeflow-centraldashboard, arangodb, kubescape-grype-offline-db, pelias-api, thingsboard-fips, argo-workflows, kubeflow-katib, kubeflow-pipelines, gitlab-rails-ce-fips, py3-captum, wazuh-dashboard, wazuh-dashboard-fips, gitlab-rails-c...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, json-server, sqlpad, kubeflow-centraldashboard, kubeflow-pipelines, argo-workflows...

CVE-2026-4867 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-4867

CVE-2026-4867 affects the path-to-regexp library. When three or more parameters occur within a single segment (e.g., /:a-:b-:c or /:a-:b-:c-:d) a bad regular expression is generated, and the backtrack protection added in [email protected] only guards two parameters. As a result, lookaheads ca...

CVE-2026-4867

creationtimestamp| type| source ---|---|--- 2026-03-26 16:03:27+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhxy56xqkc27 2026-03-26 22:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhym5fbmva2x 2026-04-17 03:37:07+00:00| seen|...

MINI-R5X8-HHFX-4867

Bulletin has no description...

MINI-V7MG-4867-PV2X

Bulletin has no description...

CVE-2022-4867

Cross-Site Request Forgery CSRF in GitHub repository froxlor/froxlor prior to 2.0.0-beta1...

CVE-2012-4867

Directory traversal vulnerability in modules/comvtigerworkflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. dot dot in the modulename parameter...

CVE-2013-4867

Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking...

CVE-2025-4867

A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function formArpNerworkSet of the file /goform/ArpNerworkSet. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2025-4867

A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function formArpNerworkSet of the file /goform/ArpNerworkSet. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2025-4867

The CVE-2025-4867 entry concerns Tenda A15 (firmware version 15.13.07.13). The vulnerability lies in the function formArpNerworkSet within the file /goform/ArpNerworkSet, where manipulation leads to a denial of service. Exploitation can be remote and the exploit has been disclosed publicly. Multi...

06-react-router-myself (>=0.0.1, <=0.0.2), 07-building-a-router (>=0.0.1, <=0.0.2) +200 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=7.0.0, <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...