CVE-2026-79770

A flaw was found in Nokogiri. A remote attacker can inject specially crafted CSS selectors into methods such as Nodecss or Nodeatcss. This injection can lead to regular expression denial of service ReDoS due to exponential regex backtracking, causing the application to become unresponsive...

CVE-2026-80205 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2023-43646

CVE-2023-43646 Resumo da vulnerabilidade CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Parte do projeto rebob Descrição da vulnerabilidade Advisories do GitHub root@kitploit: /\sfunction?:\s|\s/^?:/+/\s^\/+/ Esta vulnerabilidade pode ser explorada quando há um desequilíbrio nos...

CVE-2024-27088

CVE-2024-27088 Panoramica della vulnerabilità CVE-2024-27088 26 Feb 2024 ReDoS nel pacchetto node.js Parte del progetto rebob Descrizione della vulnerabilità github advisories root@kitploit: /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ Questa vulnerabilità può essere sfruttata quando c'è uno...

Linux Distros Unpatched Vulnerability : CVE-2026-79770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifi...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

EUVD-2026-65528

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79770

Nokogiri versions before 1.19.3 are vulnerable to ReDoS (Regular Expression Denial of Service) in the CSS selector tokenizer , specifically in string-literal and identifier tokenization. An attacker who can supply adversarial CSS selectors to methods such as Node#css, Node#at_css, or Searchable#s...

CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-54284

creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:04+00:00| published-proof-of-concept| https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f 2026-08-18 01:00:04+00:00| published-proof-of-concept| Telegram/GwuC3cy-OzU2KFCuHYMrTkUTBOKWE1Dd5EfEUwy3SR6M 2026-08-...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CVE-2026-72912 affects CyberChef (web app). The vulnerability lies in the pretty-recipe parser in src/core/Utils.mjs, where a malformed #recipe= URL fragment with many unmatched quote characters triggers a heavy backtracking path in a complex global regular expression. This causes client-side CPU...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in...

PT-2026-69980

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.3.0 Description The pretty-recipe parser in src/core/Utils.mjs can cause client-side CPU exhaustion when processing a malformed recipe= URL fragment containing numerous unmatched quote characters. This occurs whe...

CVE-2026-67422 pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...