CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

PT-2026-71683

Name of the Vulnerable Software and Affected Versions Perl versions 5.9.4 through 5.41.8 Description Incorrect regular expression match results occur when a stale failure flag causes the Aho-Corasick prescan to end prematurely in the S find byclass function. The prescan identifies potential match...

CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

PT-2026-75915

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...

Linux Distros Unpatched Vulnerability : CVE-2026-18503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass...

CVE-2026-67991

The crmne/ruby_llm gem (specifically at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 ) contains a polynomial-time regular expression denial-of-service (ReDoS) condition within the RubyLLM::Utils.underscore method on Ruby 3.1.x . An attacker can trigger excessive CPU consumption and a denial of...

PT-2026-71671

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An unauthenticated request to the '/v1/completions' endpoint can cause a denial of service by consuming a CPU core and stalling the structured-output engine path. This occurs because the structured...

CVE-2026-73425

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425

CVE-2026-73425 affects Astro with the Netlify adapter prior to 8.1.2. The root cause is in remotePatternToRegex: dots in hostnames are escaped, but pathname metacharacters (., +, ?, (, [) are not escaped, so a restrictive pathname like /img/v1.0/file can match unintended paths. Netlify enforces t...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

SUSE CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

PT-2026-71340

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote images for Netlify's Image CDN allowlist. In...

Security Bulletin:Vulnerability in Perl affects IBM Netezza Appliance

Summary The Perl package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-8376 Vulnerability Details CVEID:CVE-2026-8376 DESCRIPTION: Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed...

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

...

GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

...

PT-2026-80487

A flaw was found in GLib. A buffer over-read can occur in the g regex replace function when used with the G REGEX RAW compile flag and case-change replacement escapes because the string append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the...

SUSE SLES12 Security Update : perl (SUSE-SU-2026:3540-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3540-1 advisory. - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds bsc1266304. -...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...