Lucene search
+L

9938 matches found

OSV
OSV
added 2026/07/14 10:40 a.m.10 views

SUSE-SU-2026:22660-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists bsc1271187. - CVE-2026-49477: Regular Expression Denial of Service ReDoS via Selector Parser bsc1271188...

7.5CVSS5.4AI score0.00522EPSS
SaveExploits2References5
NVD
NVD
added 2026/07/13 8:16 p.m.11 views

CVE-2026-55773

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

8.8CVSS0.00518EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/13 7:17 p.m.11 views

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

8.8CVSS6.1AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/13 7:17 p.m.41 views

CVE-2026-55773 CedarJava has a policy injection vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

8.8CVSS0.00518EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/13 7:17 p.m.9 views

CVE-2026-55773

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

8.8CVSS6.1AI score0.00518EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/13 3:46 p.m.9 views

PYSEC-2026-3072 Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Summary The CSS selector parser in soupsieve the CSS selector engine for Beautiful Soup 4 contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the VALUE regex pattern in cssparser.py enters exponential...

7.5CVSS6AI score0.00522EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/13 2:36 p.m.9 views

PYSEC-2026-2907 PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

Summary MCPToolIndex.searchtools compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete...

6.5CVSS6.1AI score0.00402EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/13 2:36 p.m.10 views

PYSEC-2026-2987 Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been release...

4.8CVSS5.8AI score0.00156EPSS
SaveExploits0References11
OSV
OSV
added 2026/07/13 2:36 p.m.9 views

PYSEC-2026-2670 multipart vulnerable to ReDoS in `parse_options_header()`

Summary The parseoptionsheader function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking ReDoS when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service DoS attacks against web...

7.5CVSS7AI score0.00718EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/13 6:12 a.m.7 views

MAL-2026-10245 Malicious code in @gt-test-exp/profiler-exp-00000009 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c84ce939d8df9588dac92328a32e8a93cc162df1c691edf60d955c440a4ea5da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.1AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/13 12:00 a.m.25 views

PT-2026-59666

Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...

8.6CVSS6.1AI score0.007EPSS
SaveExploits0References8
F5 Networks
F5 Networks
added 2026/07/10 7:53 a.m.14 views

K000162182: Spring Expression Language (SpEL) vulnerability CVE-2026-41850

Security Advisory Description Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading...

7.5CVSS6.1AI score0.0036EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/09 10:52 p.m.10 views

Security Bulletin: Multiple Vulnerabilities in Minimatch bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the minimatch library, which is susceptible to multiple Denial of Service DoS vulnerabilities due to algorithmic inefficiencies and catastrophic regular expression backtracking. A remote attacker could exploit these...

8.7CVSS5.9AI score0.00519EPSS
SaveExploits3Affected Software2
OSV
OSV
added 2026/07/09 9:03 p.m.37 views

GHSA-PX5M-H76G-P7P8 YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

Summary An unsafe execution vulnerability exists in the Bazar form field calculator CalcField.php of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval function. This implementation is...

9.8CVSS6.4AI score0.00561EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/09 9:03 p.m.16 views

EUVD-2026-35181

YesWiki has Unsafe eval in its Formula Calculato, Leading to Remote Code Execution & Denial of Service...

9.8CVSS6.1AI score0.00561EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/07/09 6:33 p.m.10 views

Insufficiently Protected Credentials

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Insufficiently Protected Credentials through the HTTP Request V3 pagination expression handling in packages/nodes-base/nodes/HttpRequest/V3/HttpRequestV3.node.ts and...

7.1CVSS6.1AI score0.00402EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/09 6:33 p.m.14 views

Insufficiently Protected Credentials

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Insufficiently Protected Credentials through the HTTP Request V3 pagination expression handling in packages/nodes-base/nodes/HttpRequest/V3/HttpRequestV3.node.ts and...

7.1CVSS6.1AI score0.00402EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/09 3:32 p.m.75 views

CVE-2026-59209

n8n is an open source workflow automation platform. Affected versions prior to 1.123.61, 2.27.4, and 2.28.1 expose a vulnerability where an authenticated user with editor access to a shared workflow can read credential-populated headers via the $request object inside an HTTP Request node’s pagina...

7.1CVSS5.9AI score0.00402EPSS
SaveExploits0References3Affected Software1
RedHat Linux
RedHat Linux
added 2026/07/09 2:49 p.m.12 views

protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors

A flaw was found in protobufjs, a library used to compile protobuf definitions into JavaScript functions. A remote attacker could exploit this vulnerability by providing a crafted descriptor that includes a non-string default value for a bytes field. This could lead to the generation of an unsafe...

8.8CVSS6.2AI score0.00407EPSS
SaveExploits0References5
Snyk
Snyk
added 2026/07/09 1:43 p.m.10 views

Regular Expression Denial of Service (ReDoS)

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by...

8.7CVSS6AI score0.00684EPSS
SaveExploits0References2
Rows per page
Query Builder