13405 matches found
CVE-2026-111714
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...
OESA-2026-4335 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4334 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4332 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
OESA-2026-4333 pcre2 security update
PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...
BIT-GITLAB-2026-97229 Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...
DoS (Denial of Service) org.springframework:spring-expression Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 7.16.0, 7.17.0, 7.18.0, 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS...
DoS (Denial of Service) axios Dependency in Jira Service Management Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.22 and 11.3.5 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticat...
DoS (Denial of Service) axios Dependency in Jira Software Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.22 and 11.3.7 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacke...
PT-2026-116113
šØ CVE-2026-111714 tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with ...
PT-2026-115874
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...
AGCRE Regular Expression Library 20261014
AGCRE is a BSD-licensed regular expression library written in C that implements pattern compilation and matching using a Pike Virtual Machine architecture. It supports POSIX regular expressions, Perl-style escapes, lazy matching, non-capturing groups, backreferences, Unicode escapes, UTF-8, and...
CVE-2026-111714: Inefficient Regular Expression Complexity
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...
GitLab Regular Expression Code Execution
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the use of a regular expression, which does not sufficiently restrict the set of allowed values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...
CVE-2026-104150
A flaw was found in AdonisJS HTTP Server. An unauthenticated remote attacker could cause a Denial of Service DoS by sending an HTTP request containing a specially crafted route parameter. Due to an inefficient regular expression in the slug route matcher, evaluating the input causes excessive CPU...
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
Description A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using router.matchers.slug on a route parameter reachable by an attacke...
GHSA-524C-H47V-M3H8 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
Description A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using router.matchers.slug on a route parameter reachable by an attacke...
CVE-2026-88753
A flaw was found in markdown2. In the extractmetadata function, an inefficient regular expression used to parse document metadata can take an exponential amount of time to process. An attacker can exploit this vulnerability by providing a crafted Markdown document, causing excessive resource...
Uncontrolled Recursion
Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the expression parser in Parser.php, which builds a node tree with no bound on nesting depth. An attacker can supply an expression containing tens of thousands of nested unary operators, array literals, binary...
Uncontrolled Recursion
Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Uncontrolled Recursion via the expression parser in Parser.php, which builds a node tree with no bound on nesting depth. An attacker can suppl...