CVE-2026-120632

A flaw was found in the Perl CGI module. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted HTTP request. Due to an inefficient regular expression used when parsing multipart/related Content-Type headers, processing non-matching headers...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...

CVE-2026-96634

This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH statements,...

GHSA-P96F-P2P2-2G3H AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...

CVE-2026-119300

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

CVE-2026-119300 Wekan: ReDoS via Unescaped User Input in RegExp

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

EUVD-2026-114193

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

CVE-2026-119300 Wekan: ReDoS via Unescaped User Input in RegExp

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

CVE-2026-119300

The open-source kanban application Wekan is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions prior to 11.11 . The root cause is the lack of escaping for regular-expression metacharacters when authenticated users provide searchTerm and query values to the user-search public...

CVE-2026-115866

A flaw was found in Starlet. When decoding chunked request bodies, an inefficient regular expression can result in catastrophic backtracking when encountering malformed chunk-size lines. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request, causing excessiv...

PT-2026-134415

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...

CVE-2026-119300: wekan: Wekan is open source kanban built with Meteor

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH statements,...

PT-2026-133683

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...

FreeBSD : py-svglib -- Multiple vulnerabilities (bdac753c-d1d5-11f1-985e-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bdac753c-d1d5-11f1-985e-901b0edee044 advisory. Dinu Gherman reports: The SVG elliptical-arc parser in svglib.utils.splitarcvalues builds a...

Linux Distros Unpatched Vulnerability : CVE-2026-106454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translat...

OESA-2026-4428 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...

OESA-2026-4427 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...

OESA-2026-4426 python-twisted security update

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fixes: Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and...