NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Summary The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking ReDoS. Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service...

CVE-2026-78626

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...

CVE-2026-78626 Improper Input Sanitization in Okta Access Gateway Protected Rules

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...

USN-8736-1 perl vulnerabilities

It was discovered that Perl incorrectly handled certain large inputs during regular expression matching. An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a denial of service or arbitrary code execution. CVE-2026-15534 It was discovered that Per...

USN-8736-1: Perl vulnerabilities

It was discovered that Perl incorrectly handled certain large inputs during regular expression matching. An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a denial of service or arbitrary code execution. CVE-2026-15534 It was discovered that Per...

PT-2026-88512

Impact The Git node's clone operation matched the destination path against the default N8N BLOCK FILE PATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the...

CVE-2026-78626: Incorrect Authorization

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...

ROS-20260907-73-0072

The vulnerability in python-pygments is related to the use of a regular expression c, which has an inefficient computational complexity. Exploiting this vulnerability may allow a remote attacker to cause a service failure...

[SECURITY] [DLA 4772-1] pcre2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4772-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2026 https://wiki.debian.org/LTS -...

Linux Distros Unpatched Vulnerability : CVE-2026-85062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in...

CVE-2026-85062

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and...

CVE-2026-85062: Inefficient Regular Expression Complexity

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and...

Linux Distros Unpatched Vulnerability : CVE-2026-84642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames,...

PT-2026-85252

Name of the Vulnerable Software and Affected Versions Colord versions prior to 2.9.4 Description Synchronous CSS color string matchers use an ambiguous numeric regular expression that allows digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is...

CVE-2026-83619

A flaw was found in xmldom, a JavaScript module used for processing XML documents. A remote attacker could exploit a vulnerability in the XML parser by submitting a specially crafted XML input. This could lead to a Denial of Service DoS, causing the affected system to become unresponsive by...

Linux Distros Unpatched Vulnerability : CVE-2026-83619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in...

CVE-2026-53611: Improper Neutralization of Special Elements used in an OS Command

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...

GHSA-6XFF-CPCQ-VPW2 vulnerabilities

Vulnerabilities for packages: grafana...

httpd: Apache HTTP Server: Denial of Service via crafted regular expressions

A flaw was found in Apache HTTP Server. This buffer underwrite vulnerability occurs when processing crafted regular expressions in the server's configuration. An attacker could potentially exploit this to cause a denial of service...