897 matches found
PT-2026-71464
Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow exists in the regular expression...
CVE-2026-63637 Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL...
CVE-2026-63637 Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL...
CVE-2026-63637
CVE-2026-63637 affects Dgraph. Prior to 25.3.8, the may beQuoteArg logic in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, enabling a crafted GraphQL query or mutation filter to inject DQL operators, disclos...
ROOT-APP-NPM-CVE-2024-45296 CVE-2024-45296 in path-to-regexp - Patched by Root
Root has patched CVE-2024-45296 in the path-to-regexp package for Root:npm. Multiple fixed versions available...
CLSA-2026-1783731816 TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 6.2.1-tuxcare.1...
CLSA-2026-1779238048 TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.12-tuxcare.1...
CLSA-2026-1777250311 TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.3-tuxcare.2...
CLSA-2026-1773360981 TuxCare security update for path-to-regexp (2 CVEs)
TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.3-tuxcare.1...
Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters
Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...
PT-2026-73967
TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.3-tuxcare.1...
PT-2026-75374
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 6.2.1-tuxcare.1...
PT-2026-74605
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.3-tuxcare.2...
PT-2026-74815
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.12-tuxcare.1...
Exploit for CVE-2026-69083
CVE-2026-69083 — SiYuan Unauthenticated SQL Injection Unauthe...
GHSA-PQPF-6VQV-6W92 Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint...
Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fph3-ghq9-vw66. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint...
CVE-2026-69083
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...
CVE-2026-69083: Improper Neutralization of Special Elements used in an SQL Command
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...