CVE-2026-101903

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

CVE-2026-101906

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101903: Inefficient Regular Expression Complexity

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

PT-2026-102362

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function is affected by a regular expression issue where lazy PEM processing causes extensive backtracking. This happens when input resembling a certificate contains repeated BEGIN...

CVE-2026-102270: Inefficient Regular Expression Complexity

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

CVE-2026-101906: Uncontrolled Resource Consumption

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-88774

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

EUVD-2026-87960

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-88774 Feature policy bypass due to improper HTTP URL based expression usage

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-88774

CVE-2026-88774 is a policy bypass vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway caused by improper HTTP URL based expression usage. The flaw affects appliances where any policy utilizes these expressions. To remediate, users should upgrade to NetScaler ADC/Gateway 14.1-73.37 ...

CVE-2026-88774 Feature policy bypass due to improper HTTP URL based expression usage

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-100864

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864

The heym library (versions prior to 0.0.91 ) contains a sandbox escape vulnerability within the expression engine 's DotList map/filter and fallback resolver. This flaw allows authenticated users to execute arbitrary Python code by crafting workflow expressions that use dunder attribute access . ...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

PT-2026-99484

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.91 Description A sandbox escape exists in the expression engine's DotList map/filter and fallback resolver. Authenticated users can execute arbitrary Python code by crafting workflow expressions that utilize dunder...

CVE-2026-100864: Improper Control of Generation of Code

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...