EUVD-2026-68324

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

UBUNTU-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725 NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-80205

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability in the Text.findall and TokenSearcher.findall methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns tha...

CVE-2026-79770

A flaw was found in Nokogiri. A remote attacker can inject specially crafted CSS selectors into methods such as Nodecss or Nodeatcss. This injection can lead to regular expression denial of service ReDoS due to exponential regex backtracking, causing the application to become unresponsive...

PT-2026-82620

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A regular expression denial of service exists in Pl196xCorpusReader. An attacker can cause quadratic CPU consumption by providing malformed TEI Text Encoding Initiative blocks containing numerous...

VulnCheck KEV: CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

Linux Distros Unpatched Vulnerability : CVE-2026-81725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption ...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

Regular Expression Denial of Service (ReDoS)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in TokenSearcher.findall and Text.findall in nltk/text.py. An attacker can pin a Python worker and...

Regular Expression Denial of Service (ReDoS)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the tgrepnodeaction path in nltk/tgrep.py. An attacker can pin a CPU core indefinitely by...

CVE-2026-80205

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...