Permissive Regular Expression

Overview Affected versions of this package are vulnerable to Permissive Regular Expression in the use of re.match to verify alloworiginpat values. This allows an attacker to bypass intended CORS restrictions and gain unauthorized access to sensitive API responses. Code execution is possible by...

Regular Expression Denial of Service (ReDoS)

Overview code-index-mcp is a Code indexing and analysis tools for LLMs using MCP Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the issaferegexpattern function of the searchcodeadvanced component. An attacker can cause excessive resource...

Regular Expression Denial of Service (ReDoS)

Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the startsearch process in search-manager.ts when handling the SearchResult argument. An attacker can...

PT-2026-60335

Уязвимость программного обеспечения для управления пользователями беспроводных сетей NETAMS WNAM связана с непринятием мер по нейтрализации специальных элементов, используемых в операторе языка выражений. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить...

CVE-2026-10692: Inefficient Regular Expression Complexity

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack...

PT-2026-57354

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is safe regex pattern of the component search code advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the atta...

PT-2026-57363

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start search. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It i...

CVE-2026-10691: Inefficient Regular Expression Complexity

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

Jupyter Server 安全漏洞

Jupyter Server is an application developed by the Jupyter organization that provides backend services for Jupyter web applications. There are security vulnerabilities in the version of Jupyter Server from 1.12.0 to 2.17.0. These vulnerabilities stem from the use of re.match in CORS source...

CVE-2026-8888: Improper Neutralization of Special Elements used in an Expression Language Statement

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in...

The vulnerability of the modular interface of the Ruby-based Rack web server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Ruby-based Rack web server’s modular interface is related to the use of a regular expression, which does not sufficiently restrict the set of allowed values. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

The vulnerability of the `MilvusVectorStore#doDelete(List)` method in the Spring AI framework for developing artificial intelligence models allows a perpetrator to compromise the integrity and accessibility of protected information.

The vulnerability of the MilvusVectorStoredoDeleteList method in the Spring AI framework for model development involves the failure to take measures to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow an attacker to compromise the...

Regular Expression Denial of Service (ReDoS)

Overview @enderfga/claw-orchestrator is a Claw Orchestrator — run Claude Code, Codex, Gemini, Cursor Agent, OpenCode and custom coding CLIs as one unified runtime. Drop into Hermes Agent, Claude Desktop, Cursor, Cline, Continue, Zed, Windsurf, Goose or any Model Context Protocol MCP host, insta...

CVE-2026-10291

A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient...

CVE-2026-10291

CVE-2026-10291 affects Enderfga claw-orchestrator (up to 3.7.0). The vulnerability lies in the function validateRegex in claw-orchestrator/src/embedded-server.ts of the Session Grep Endpoint , where manipulating the argument body.pattern leads to inefficient regular expression complexity. Remote ...

BIT-KIBANA-2026-42399 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression...

CVE-2026-10291: Inefficient Regular Expression Complexity

A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient...

The vulnerability of the JavaScript-based Thymeleaf framework lies in the lack of measures taken to neutralize special elements used in the expression language. This allows attackers to execute Server Side Template Injection (SSTI) attacks.

The vulnerability of the JavaScript-based Thymeleaf framework is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to execute a Server Side Template Injection SSTI attack...

CVE-2026-42399

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression...