PT-2026-97504

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions 4.x through 4.3.0 Description The built-in less viewer in this Java library for console input passes user-controlled search and display-filter patterns from the getPatternboolean...

Linux Distros Unpatched Vulnerability : CVE-2026-92599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. O...

GitLab 19.2 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-93577)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

CVE-2026-19179: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression...

CVE-2026-66074: Inefficient Regular Expression Complexity

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-77423: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

PT-2026-97616

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 through 19.4.0 Description An authenticated user can execute arbitrary code on the server due to a double free issue—a memory...

CVE-2026-77422: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

GitLab 19.2 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-89078)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

CVE-2026-77420: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2025-12767

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption...

CVE-2025-12767

IBM Concert versions 1.0.0 through 3.0.0 are vulnerable to a denial of service condition. A remote attacker can exploit this by providing a specially crafted regular expression that triggers excessive resource consumption . No specific remediation steps or exploit details are provided in the docu...

CVE-2025-12767 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption...

CVE-2025-12767 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption...

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

GHSA-JPVM-9FRM-HJCQ Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

CVE-2026-57149

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

BIT-LIBPYTHON-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

PT-2026-97060

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote attacker can cause a denial of service by using a specially crafted regular expression. This leads to excessive resource consumption, which can crash or freeze the system...

CVE-2025-12767: Allocation of Resources Without Limits or Throttling

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption...