CVE-2026-4923

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /foo-bar-:baz /a-:b-c-:d...

UBUNTU-CVE-2026-4923

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /foo-bar-:baz /a-:b-c-:d...

01-numacert (>=1.0.0, <=3.0.0), 05day (1.0.0) +15995 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=0.0.2, <=0.1.12)

path-to-regexp NPM version =0.0.2, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.2.3 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: SNYK:JS-PATHTOREGEXP-15789761...

com.codbex.aion:codbex-aion-platform (>=0.5.6, <=0.5.7), com.codbex.aion:codbex-aion-platform-keycloack (>=0.5.6, <=0.5.7) +95 more potentially affected by CVE-2024-45296 +1 more via org.webjars.npm:path-to-regexp (>=0.1.7, <=8.4.2)

org.webjars.npm:path-to-regexp MAVEN version =0.1.7, =0.5.6, =0.5.6, =0.5.6, =0.4.0, =0.4.0, =0.5.3, =0.5.5 - com.codbex.kronos:codbex-kronos-coverage-aggregate 0.4.0 - com.codbex.kronos:codbex-kronos-modules-all 0.4.0 - com.codbex.kronos:codbex-kronos-modules-engines-all 0.4.0 -...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +27 more potentially affected by CVE-2026-33750 via brace-expansion (>=1.1.0, <=1.1.11)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =0.0.3, =0.0.1, =0.1.0 and more Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2903 more potentially affected by CVE-2026-33750 via brace-expansion (>=4.0.0, <=5.0.2)

brace-expansion NPM version =4.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

CVE-2026-29856

An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service ReDoS via a crafted input...

SUSE-SU-2026:1066-1 Security update for ruby2.5

This update for ruby2.5 fixes the following issues: - CVE-2024-49761: ReDoS vulnerability in REXML gem bsc1232440 bsc1232441. - CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations bsc1250016. - CVE-2026-27820: insufficient checks in zstreambufferungets can lead...

CVE-2026-4923: Inefficient Regular Expression Complexity

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /foo-bar-:baz /a-:b-c-:d...

CVE-2026-33671: Inefficient Regular Expression Complexity

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as + and , especially when combined with overlapping...

Linux Distros Unpatched Vulnerability : CVE-2026-4923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtrackin...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33672 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.0.0-0, <=11.3.0-1), @142vip/midway (>=0.1.6-alpha.2, <=0.1.6-alpha.12) +575 more potentially affected by CVE-2026-33672 via picomatch (>=2.1.1, <=2.3.1)

picomatch NPM version =2.1.1, =11.0.0-0, =0.1.6-alpha.2, =7.4.1, =0.0.1, =1.0.1, =0.0.2, =2.0.0, =9.0.0-alpha.28, =9.2.0-alpha.9, =9.2.0-alpha.9, =1.0.101, =1.1.0, =1.4.1 and more Source cves: CVE-2026-33672 Source advisory: SNYK:JS-PICOMATCH-15765513...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @4itech/schematics (>=11.7.1, <=11.7.6) +1090 more potentially affected by CVE-2026-33672 via picomatch (>=4.0.0, <=4.0.3)

picomatch NPM version =4.0.0, =11.7.1, =1.2.0, =8.3.0-rc.2, =1.0.25, =0.26.4, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =10.0.0-alpha.1, =10.0.0-prerelease.90, =13.0.0-next.10, =14.3.0-prerelease.1 and more Source cves: CVE-2026-33672 Source advisory: SNYK:JS-PICOMATCH-15765513...

4itech-schematics (>=11.0.0-0, <=11.3.0-1), @142vip/midway (>=0.1.6-alpha.2, <=0.1.6-alpha.12) +575 more potentially affected by CVE-2026-33672 via picomatch (>=2.1.1, <=2.3.1)

picomatch NPM version =2.1.1, =11.0.0-0, =0.1.6-alpha.2, =7.4.1, =0.0.1, =1.0.1, =0.0.2, =2.0.0, =9.0.0-alpha.28, =9.2.0-alpha.9, =9.2.0-alpha.9, =1.0.101, =1.1.0, =1.4.1 and more Source cves: CVE-2026-33672 Source advisory: OSV:GHSA-3V7F-55P6-F55P...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @4itech/schematics (>=11.7.1, <=11.7.6) +1090 more potentially affected by CVE-2026-33672 via picomatch (>=4.0.0, <=4.0.3)

picomatch NPM version =4.0.0, =11.7.1, =1.2.0, =8.3.0-rc.2, =1.0.25, =0.26.4, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =10.0.0-alpha.1, =10.0.0-prerelease.90, =13.0.0-next.10, =14.3.0-prerelease.1 and more Source cves: CVE-2026-33672 Source advisory: OSV:GHSA-3V7F-55P6-F55P...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @4itech/schematics (>=11.7.1, <=11.7.6) +1090 more potentially affected by CVE-2026-33671 via picomatch (>=4.0.0, <=4.0.3)

picomatch NPM version =4.0.0, =11.7.1, =1.2.0, =8.3.0-rc.2, =1.0.25, =0.26.4, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =10.0.0-alpha.1, =10.0.0-prerelease.90, =13.0.0-next.10, =14.3.0-prerelease.1 and more Source cves: CVE-2026-33671 Source advisory: SNYK:JS-PICOMATCH-15765511...

@actinc/eslint-config (>=4.10.0, <=4.16.0), @alexgorbatchev/dotfiles (>=0.0.1, <=1.0.4) +325 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.6.0)

smol-toml NPM version =1.1.2, =4.10.0, =0.0.1, =2.8.0, =0.1.0-alpha.0, =0.1.3, =0.1.3, =0.1.3, =0.2.2, =0.32.3, =0.2.2, =1.0.0, =1.0.4, =0.2.0, =0.0.4, =0.0.4, =9.0.0-canary.1784 and more Source cves: unknown CVE Source advisory: OSV:GHSA-V3RJ-XJV7-4JMQ...

CVE-2026-33169

CVE-2026-33169 affects Active Support (Rails core extensions). The issue arises in NumberToDelimitedConverter, which uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Interaction between a repeated lookahead group and gsub! can cause quadratic time complexity on...