CVE-2026-25477 AFFiNE: Open Redirect via Regex Bypass in redirect-proxy

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to...

BIT-GITLAB-2026-1388 Inefficient Regular Expression Complexity in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint und...

PT-2026-25116

Summary extensions/feishu/src/bot.ts constructed new RegExp directly from Feishu mention metadata mention.name, mention.key in stripBotMention without escaping regex metacharacters. Affected Packages / Versions - Package: npm openclaw - Affected versions: = 2026.2.17 - First affected release:...

PT-2026-26009

Summary extensions/feishu/src/bot.ts constructed new RegExp directly from Feishu mention metadata mention.name, mention.key in stripBotMention without escaping regex metacharacters. Affected Packages / Versions - Package: npm openclaw - Affected versions: = 2026.2.17 - First affected release:...

flyway:LocationFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

Project: https://github.com/flyway/flyway.git Detailed Report: https://oss-fuzz.com/testcase?key=6083664621666304 Project: flyway Fuzzing Engine: libFuzzer Fuzz Target: LocationFuzzer Job Type: libfuzzerasanflyway Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

GitLab 9.2 < 18.7.5 / 18.8 < 18.8.5 / 18.9 < 18.9.1 (CVE-2026-1388)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Inefficient Regular Expression Complexity in GitLab CVE-2026-1388 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2025-10990 Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...

CVE-2025-10990 Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...

CVE-2025-10990 Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...

CVE-2026-3293 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos

A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts...

CVE-2026-3293

CVE-2026-3293 affects snowflake-bdb snowflake-jdbc up to 4.0.1, specifically the SdkProxyRoutePlanner (src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java) in the JDBC URL Handler. The vulnerability arises from manipulating the nonProxyHosts argument, which can cause ineffi...

CVE-2026-3293

A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts...

PT-2025-46138

Name of the Vulnerable Software and Affected Versions REXML affected versions not specified Description A flaw exists in REXML related to inefficient regular expression regex parsing when processing hex numeric character references &x... in XML documents. This can lead to a Regular Expression...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1200 more potentially affected by CVE-2026-27903 via minimatch (>=10.0.0, <=10.2.2)

minimatch NPM version =10.0.0, =0.0.1, =1.0.0, =6.0.0-test.1, =10.0.0, =10.0.0, =8.0.1, =13.0.0, =5.1.3, =0.2.0, =0.5.1-alpha.0, =4.10.0, =0.0.0-next-023d8d0, =0.0.0-next.d8e717b and more Source cves: CVE-2026-27903 Source advisory: OSV:GHSA-7R86-CG39-JMMJ...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 02.aula (1.0.0) +55735 more potentially affected by CVE-2026-27903 via minimatch (>=3.0.0, <=3.1.2)

minimatch NPM version =3.0.0, =1.0.1, =1.1.0 - 02.aula 1.0.0 - 0726react 0.1.1 - 08cms 1.0.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 -...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27903 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27903...

GHSA-23C5-XMQV-RM74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Summary Nested extglobs produce regexps with nested unbounded quantifiers e.g. ?:?:a|b, which exhibit catastrophic backtracking in V8. With a 12-byte pattern a|b and an 18-byte non-matching input, minimatch stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes...

@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +899 more potentially affected by CVE-2026-27904 via minimatch (>=5.0.0, <=5.1.7)

minimatch NPM version =5.0.0, =1.0.7, =10.4.0, =9.0.0, =10.0.0, =10.0.0, =10.5.0, =10.4.0, =0.4.13, =2.3.0, =2.3.0, =2.2.1, =2.2.1, =2.2.2 - @aid-on/aidify 0.1.2 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +318 more potentially affected by CVE-2026-27904 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27904 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27904...