cve-2026-31900-lab

CVE-2026-31900 — Vulnerable Lab psf/black GitHub Action RCE via Insecure Regex Validation Field| Detail ---|--- CVE| CVE-2026-31900 CVSS| 8.7 High Advisory| GHSA-v53h-f6m7-xcgm Affected| psf/black GitHub Action v26.3.0 Type| RCE via Supply Chain pullrequest trigger Vulnerability The usepyproject:...

Exploit for CVE-2026-97229

CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE Technical...

Exploit for CVE-2026-97229

CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE Technical...

GO-2026-6519 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

Capsule: hostnameRegexHandler.OnUpdate validates stale old Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule...

Multiple perl vulnerabilities impact AIX.

IBM SECURITY ADVISORY First Issued: Mon Sep 28 00:55:59 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/perladvisory14.asc Security Bulletin: Multiple perl vulnerabilities impact AIX...

CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Summary NLTK's Text.findall and TokenSearcher.findall methods accept user-supplied regular expressions and pass them to the Python re engine without timeout or validation, enabling catastrophic backtracking ReDoS. This issue is isolated to the nltk.text module and was resolved in a prior commit...

SUSE CVE-2026-65834

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

XMLDOM XML Data Compromise

The vulnerability of the serialization for XML documents related to access control and management is related to the use of regular expressions, which do not sufficiently restrict the set of allowed values. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of...

Fedora 44 : python-linkify-it-py (2026-7c23b06d74)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c23b06d74 advisory. Security release: LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. - Fix quadratic complexity in...

Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...

CVE-2026-80205

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability in the Text.findall and TokenSearcher.findall methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns tha...

CVE-2026-80205

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

CVE-2026-75840

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type to access java.util.zip.ZipFile or...

CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

GHSA-2MHJ-FHVG-V428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

PT-2026-75915

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...