4769 matches found
PT-2026-39944
The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filter images function in all versions up to, and including, 1.0.9. This is due to the use of regex-based HTML processing preg replace that does not properly handle HTML attribute boundaries when replacing...
PT-2026-39996
Name of the Vulnerable Software and Affected Versions multiparty versions prior to 4.3.0 Description A denial of service issue exists due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload containing a long header value can cause...
PT-2026-40297
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...
Unity Linux 20.1060e / 20.1070e Security Update: rubygem-actionpack (UTSA-2026-017610)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017610 advisory. The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action...
CVE-2026-7259
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...
Unity Linux 20.1060e / 20.1070e Security Update: clamav (UTSA-2026-017365)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017365 advisory. A vulnerability in the regex module used by the signature database load module of Clam AntiVirus ClamAV versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and...
CLSA-2026-1778152899 httpd: Fix of 2 CVEs
CVE-2017-15710: modauthnzldap out-of-bounds write when accept-language header value is shorter than two characters - CVE-2017-15715: regex anchor in / can match before an embedded newline, allowing .htaccess bypass of trailing-extension filters...
EUVD-2023-50669
Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...
SUSE CVE-2026-33079
In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...
CVE-2023-46453
Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...
ROS-20260508-73-0014
Vulnerability in nodejs-minimatch related to the use of regular expression with inefficient computational complexity. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
@awinogrodzki/embed-plugin-youtube (>=5.0.5, <=5.0.9), @radio4000/components (>=0.0.24, <=0.2.17) +11 more potentially affected by CVE-2025-65122 via youtube-regex (1.0.5)
youtube-regex NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on youtube-regex and may be impacted: - @awinogrodzki/embed-plugin-youtube =5.0.5, =0.0.24, =1.0.0, =0.1.0-alpha.15063db7, =0.1.0-alpha.15063db7, =0.0.2, =1.0.1, =0.6.0, =2.1....
EUVD-2025-209731
Regex Denial of Service in youtube-regex npm package through version 1.0.5...
@awinogrodzki/embed-plugin-youtube (>=5.0.5, <=5.0.9), @radio4000/components (>=0.0.24, <=0.2.17) +11 more potentially affected by CVE-2025-65122 via youtube-regex (1.0.5)
youtube-regex NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on youtube-regex and may be impacted: - @awinogrodzki/embed-plugin-youtube =5.0.5, =0.0.24, =1.0.0, =0.1.0-alpha.15063db7, =0.1.0-alpha.15063db7, =0.0.2, =1.0.1, =0.6.0, =2.1....
Allocation of Resources Without Limits or Throttling
Overview youtube-regex is a The correct Youtube video id regex! Regex done right! Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the regex param. An attacker can cause excessive resource consumption by supplying crafted input that...
GHSA-VPXX-H23G-GXH2 youtube-regex vulnerable to Regex Denial of Service
Regex Denial of Service in youtube-regex npm package through version 1.0.5...
NPM: youtube-regex vulnerable to Regex Denial of Service
NPM: youtube-regex vulnerable to Regex Denial of Service vulnerability discovered by ? in WordPress Npm youtube-regex versions = 1.0.5...
youtube-regex vulnerable to Regex Denial of Service
Regex Denial of Service in youtube-regex npm package through version 1.0.5...
CLSA-2026-1778178379 httpd: Fix of 2 CVEs
CVE-2017-15710: modauthnzldap out-of-bounds write when accept-language header value is shorter than two characters - CVE-2017-15715: regex anchor in / can match before an embedded newline, allowing .htaccess bypass of trailing-extension filters...
