CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service ReDoS fix at Everything 1.5 alpha Suggested description Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...

CVE-2025-60423

Authentication Bypass: 7.2.8 This authentication bypass is similar to Shiro's permission bypass. In the dofilterInternal method of the sessionfilter class, the default dofilter parameter is true, and only when it is false can authentication be bypassed. Following into the matches method, this cod...

CVE-2019-19203

CVE-2019-19203 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function gb18030mbcenclen in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantul...

cve-2026-31900-lab

CVE-2026-31900 — Vulnerable Lab psf/black GitHub Action RCE via Insecure Regex Validation Field| Detail ---|--- CVE| CVE-2026-31900 CVSS| 8.7 High Advisory| GHSA-v53h-f6m7-xcgm Affected| psf/black GitHub Action v26.3.0 Type| RCE via Supply Chain pullrequest trigger Vulnerability The usepyproject:...

jsleak

jsleak jsleak is a tool to identify sensitive data in JS files through regex patterns. Although it's built for this, you can use it to identify anything as long as you have a regex pattern for it. How to install Directly: your package manager install pkg-config libpcre++-dev go get...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2025-41244-PoC

CVE-2025-41244 PoC VMware Aria Operations &1" VERSIONEND done Excerpt from get-versions.sh lines 119-124: getversion "/\S+/httpd-prefork|httpd|httpd2-prefork$|\s" -v getversion "/usr/bin|sbin/apache\S" -v getversion "/\S+/mysqld$|\s" -V getversion ".?/\Snginx$|\s" -v getversion...

GitMiner3

Autor: UnkL4b Site: bravul.com Blog: unkl4b.github.io Github: UnkL4b X: @UnkL4b WARNING +---------------------------------------------------+ | DEVELOPERS ASSUME NO LIABILITY AND ARE NOT | | RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY | | THIS PROGRAM |...

EUVD-2026-113907

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-96741

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-112585

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-96741 DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-96741

The DSGVO All in one for WP plugin for WordPress (all versions up to and including 5.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the Comment Content via Output Buffer Regex Corruption . This flaw allows unauthen...

EUVD-2026-110319

Tornado: Open redirect in RedirectHandler via protocol-relative URLs...

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

GHSA-CCRJ-GW8R-854M opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

CVE-2026-118686

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a Denial of Service (DoS) attack. The root cause is an inefficient password-redaction regular expression used during API error handling, which consumes excessive CPU resources when processing long request bodies. Unauthentica...

CVE-2026-118686 EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of larg...

CVE-2026-118686 EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of larg...