5026 matches found
CVE-2026-71190
A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causin...
openSUSE 16 Security Update : nginx (openSUSE-SU-2026:21524-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21524-1 advisory. This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514. Tenable has extracted the...
EulerOS 2.0 SP13 : perl (EulerOS-SA-2026-3035)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds...
EulerOS 2.0 SP13 : perl (EulerOS-SA-2026-2985)
According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds...
Exploit for CVE-2026-42533
CVE-2026-42533 Pre-auth heap buffer overflow and heap informa...
CVE-2026-49331
A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...
DEBIAN-CVE-2026-71287
Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...
CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...
CVE-2026-71209
Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...
CVE-2026-71190
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...
SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3469-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3469-1 advisory. This update for nginx fixes the following issue: - CVE-2026-42533: referencing regex capture variables before map output variables can trigg...
CVE-2026-70493
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...
GHSA-2F54-P244-32Q6 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...
CVE-2026-70493
Open WebUI vulnerability CVE-2026-70493 affects the knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py for builds from 0.9.6 to 0.11.0. A chat participant can supply a pattern containing regex metacharacters; these patterns were compiled with...
CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...
CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...
GHSA-52FH-8V99-63C2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...
Malicious code in @onereach/regex-helper (npm)
npm/@onereach/regex-helper is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...