5901 matches found
GHSA-G53G-W8RJ-FMG7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Summary Pl196xCorpusReader still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs. Details - Vulnerability type:...
EUVD-2026-66397
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions...
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
Summary NLTK's Text.findall and TokenSearcher.findall methods accept user-supplied regular expressions and pass them to the Python re engine without timeout or validation, enabling catastrophic backtracking ReDoS. This issue is isolated to the nltk.text module and was resolved in a prior commit...
EUVD-2026-66396
NLTK: ReDoS in nltk.text.Text.findall via unvalidated user-supplied regular expressions...
EUVD-2026-74174
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...
CVE-2026-78626 Improper Input Sanitization in Okta Access Gateway Protected Rules
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...
Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Predict Component uses ITOM Rel 3.0.0: idna-3.11-py3-none-any.whl which are vulnerable to CVE-2026-45409. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names ...
Fedora 43 : GitPython (2026-e6bd4d25ab)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e6bd4d25ab advisory. Version 3.1.60 fixes GHSA-g5vv-9gxw-82hx, GHSA-whh4-5q6c-9v3x, and GHSA-239g-whfq-7xj9. Version 3.1.61 fixes accidental removal of public class regex on Acto...
PT-2026-88437
Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description Improper input sanitization and regular expression evaluation within the Protected Rule authorization check allow for an authorization bypass. This occurs when an administrator ha...
CVE-2026-2390
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
EUVD-2026-72350
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
CVE-2026-2390
The Powerkit WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via its Lazy Load module's image processing in all versions up to and including 3.0.4 . The root cause is the content_process_images function, which relies on a flawed regex-based HTML attribute parser, allowing auth...
CVE-2026-2390 Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
CVE-2026-2390 Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...
WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...
PT-2026-86682
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content process images' function using a flawed regex-based HTML attribute parser. This makes it possible for...
TencentOS Server 4: python3.11 (TSSA-2026:0969)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0969 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2026-19487
A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications tha...
