UBUNTU-CVE-2026-109563

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

CVE-2026-109563

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

EUVD-2026-97886

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

CVE-2026-109563 N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

CVE-2026-109563

The N3.js library, specifically versions before 2.11.1 , is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the N3Lexer number pattern, which exhibits quadratic backtracking when processing long runs of digits. An attacker can exploit this by providing untruste...

CVE-2026-109563

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

CVE-2021-32644

CVE-2021-32644 This vulnerability is an XSS vulnerability that affected versions prior to Ampache 4.4.3. https://nvd.nist.gov/vuln/detail/CVE-2021-32644 Installation and Execution Steps 1. Install Ampache When installing, please configure port forwarding in the docker-compose.yml file. The...

CVE-2026-109308

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig, allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates...

CVE-2026-109297

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rul...

CVE-2026-109308

Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 are vulnerable to Remote Code Execution (RCE) via behavior injection. The flaw exists because the AppController::actionCacheUpdates function passes the raw updates request parameter to UpdatesModel without calling Component::cleanseC...

EUVD-2026-97610

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig, allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates...

EUVD-2026-97601

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update...

CVE-2026-109297 Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rul...

EUVD-2026-97600

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grepknowledgefiles with short...

CVE-2026-109297 Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rul...

CVE-2026-109297

The Open WebUI application versions 0.11.0 before 0.11.4 are vulnerable to a Denial of Service (DoS) attack via the automation recurrence-rule validator . The root cause is a discrepancy where the sub-daily frequency guard parses rule text more strictly than the underlying calendar library used f...

EUVD-2026-97599

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rul...

CVE-2026-109295 Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grepknowledgefiles or grepchatfiles with a catastrophically backtracking...

CVE-2026-109295

The Open WebUI software (versions 0.11.0 before 0.11.4 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause is inefficient regular expression complexity (CWE-1333) within the grep_knowledge_files or grep_chat_files functions. Authenticated users can exploit this by i...

CVE-2026-109295 Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grepknowledgefiles or grepchatfiles with a catastrophically backtracking...