Budibase - Authentication Bypass

Budibase = 3.31.4 contains an authentication bypass caused by unanchored regex in authorized middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL. id:...

CVE-2026-93869

Cotonti through version 1.0.0 is affected by an open redirect vulnerability in the cot_url_check() function (defined in system/functions.php). The root cause is a regular expression that validates redirect destinations but lacks an end-of-string anchor , allowing attackers to bypass the guard by ...

EUVD-2026-81299

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...

CVE-2026-92599

joi (npm package, hapi.js) versions >=17.2.0 =18.0.0

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553

Note Mark (open-source Go note-taking app, module github.com/enchant97/note-mark/backend) is vulnerable to a path traversal in its data-export CLI commands (migrate export and migrate export-v1) prior to version 0.19.5 . The root cause is an unanchored regex ([a-z0-9-]+) used to validate book and...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-53611

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2026-53611

Looking Glass is a stateless network-diagnostic platform (single Go binary) that fronts routers over SSH and exposes ping, traceroute, and BGP lookups via gRPC, a SvelteKit web UI, and a CLI. Prior to version 1.3.5 , an unanchored regular expression in the BGPASPath input validation layer allows ...

EUVD-2026-70199

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2026-53611 Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2026-53611 Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2026-75757

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

EUVD-2026-68324

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...