CVE-2026-110594: Inefficient Regular Expression Complexity

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110449: Integer Overflow or Wraparound

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled...

AGCRE Regular Expression Library 20261013

AGCRE is a BSD-licensed regular expression library written in C that implements pattern compilation and matching using a Pike Virtual Machine architecture. It supports POSIX regular expressions, Perl-style escapes, lazy matching, non-capturing groups, backreferences, Unicode escapes, UTF-8, and...

Linux Distros Unpatched Vulnerability : CVE-2026-110869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain...

CVE-2026-108376

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.getfielddefault inserts a schema-controlled referenced record name into the callable...

CVE-2026-104126 JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation...

CVE-2026-96299

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

CVE-2026-96299

The MongoDB Server is vulnerable to a memory exhaustion (OOM ) condition due to missing resource limits in the match expression evaluator . The flaw allows an authenticated user with read-only privileges to execute an aggregation query using nested internal schema validation operators (intended f...

EUVD-2026-98812

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

Exploit for Expression Language Injection in Apache Struts

POC-for-CV...

Exploit for Expression Language Injection in Apache Struts

POC-EXPLO...

Security Bulletin: Spring Expression Language (SpEL) in IBM Sterling Control Center makes it vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)

Summary A Critical vulnerability in Spring Framework that allows a safety guard bypass when evaluating Spring Expression Language SpEL expressions using SimpleEvaluationContext with the expression compiler enabled, potentially leading to unauthorized actions or remote code execution; affected...

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound CWE-190 in the CI/CD regular expression compiler affecting GitLab Community Edition CE and Enterprise Edition EE. GitLab assigned the vulnerability a CVSSv3.1 score of 10....

Exploit for Expression Language Injection in Apache Struts

CVE-2026-104711 - Advanced Variant PoC exploit for CVE-2026-1...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-1047...

BIT-GHOST-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-10471...

Exploit for Expression Language Injection in Apache Struts

CVE-202...

ALPINE-CVE-2026-97229

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...

UBUNTU-CVE-2026-97229

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...