PT-2026-78937

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description A regular expression denial of service ReDoS exists in the Filter and Switch nodes. The issue occurs because user-supplied regex...

perl-Date-Manip security update

6.60-3.1 - Fix CVE-2026-60075: prevent ReDoS via crafted strings with long interior whitespace runs in date/time parsing - Resolves: RHEL-239807...

CVE-2026-76401

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event...

CVE-2026-76401

Splunk Connect for Kafka versions below 2.2.7 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability in the timestamp extraction feature. An unauthenticated user with network access to the Kafka Connect REST API can configure timestamp extraction with a crafted regular expre...

Regular Expression Denial of Service (ReDoS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the regexReplace process. An attacker can exhaust server resources and cause denial of service b...

CVE-2026-62317

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

EUVD-2026-62757

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-62317 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-62317

CVE-2026-62317 is a ReDoS vulnerability in Logto (open-source auth infrastructure) prior to version 1.41.0. When the blockSubaddressing policy is enabled, the email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts constructs a regex (subaddressin...

CVE-2026-62317 Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when...

CVE-2026-62672

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

CVE-2026-62672

Grav (file-based web platform) prior to 2.0.4 is vulnerable to an authenticated ReDoS via the regex_replace filter and function in the Twig content sandbox. The root cause is that GravExtension::regexReplace() passes an editor-controlled pattern directly to PHP's preg_replace() without sanitizati...

CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

CVE-2026-18503

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

PT-2026-78644

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0 Description When the blockSubaddressing feature is enabled, the software uses an attacker-controlled domain from the email input to construct a regular expression. Due to a permissive emailRegEx that accepts...

PT-2026-78488

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Grav allows the regex replace filter and function in system/config/security.yaml. The GravExtension::regexReplace function passes a pattern controlled by the editor directly to preg replace. When...

UBUNTU-CVE-2026-15806

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...