13466 matches found
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
SummaryThe built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...
Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance
Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...
Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance
Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to...
EUVD-2026-55081
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...
CVE-2026-64940
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...
Spring Cloud Function - routing-expression RCE (CVE-2022-22963)
Exploits CVE-2022-22963 by injecting SpEL into the spring.cloud.function.routing-expression header to run a reverse CMD payload. Waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Function routing-expression RCE CVE-2022-22963 — reverse session.""" import base64...
Spring Cloud Function - routing-expression Detection (CVE-2022-22963)
Probes Spring Cloud Function endpoints for acceptance of the spring.cloud.function.routing-expression header CVE-2022-22963. Uses a non-destructive SpEL expression; confirmation of RCE requires the companion exploit with a reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud...
CVE-2026-19278: Permissive Regular Expression
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-64940: Permissive Regular Expression
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...
PT-2026-76460
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
PT-2026-69390
Name of the Vulnerable Software and Affected Versions Tegalog -Fumy Otegaru Memo Logger- affected versions not specified Description The software contains a flaw caused by a permissive regular expression. This allows an attacker with access to the product to bypass authentication and log in to th...
CVE-2026-18503: Inefficient CPU Computation
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
CVE-2026-15534
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...
CVE-2026-15534
Perl versions through 5.45.1 are vulnerable to out-of-bounds heap reads and writes during regular expression matching. The root cause is a positive overflow of a signed 32-bit count in the regex engine's superlinear cache within S_regmatch . Specifically, when matching a large subject against a p...
CVE-2026-69207
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...
CVE-2026-69207
Hono’s built-in CORS middleware (hono/cors) is vulnerable to a ReDoS in the Access-Control-Request-Headers parsing during preflight requests when allowHeaders is unset/empty. The regex-based parser can backtrack quadratically with long whitespace, potentially causing seconds of CPU usage per pref...
CVE-2026-69207 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...
DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...
CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...
EUVD-2026-54519
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...