HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches, matchesFull, and replaceMatches pass user-controlled regular expressions directly to Java's Pattern.compile and String.replaceAll without...

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

Impact A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a TaggedSigned with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches...

Open WebUI code-related vulnerabilities

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Versions of Open WebUI prior to 0.9.0 had code vulnerabilities. These vulnerabilities stemmed from the validators.ipv6 function in validateurl, which did not implement the private keyword for IPv6. A...

10tcl (>=0.0.6, <=0.0.10), 47pages-keystone (>=0.0.1, <=0.0.5) +692 more potentially affected by CVE-2014-8882 via validator (>=0.1.8, <=3.19.1)

validator NPM version =0.1.8, =0.0.6, =0.0.1, =1.0.0, =0.0.1, =0.3.21-3, =0.3.1-integration, =1.7.99, =9.7.4, =1.0.1-rc6, =1.1.1 and more Source cves: CVE-2014-8882 Source advisory: MEND:CVE-2014-8882...

CVE-2014-8882

Versions of "validator" prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the "isURL" method...

10tcl (>=0.0.6, <=0.0.10), @rtoken/contracts (1.0.1-rc6) +120 more potentially affected by unknown CVE via validator (>=0.1.8, <=1.0.0)

validator NPM version =0.1.8, =0.0.6, =1.0.1-rc6, =1.0.2, =0.0.1, =0.1.0-1, =0.3.3, =0.5.0, =1.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.9 - azure 0.6.9-zumo and more Source cves: unknown CVE Source advisory: MEND:WS-2013-0001...

WS-2013-0001

XSS Filter Bypass in validator Node.js Module.In general, because the function’s filtering is blacklist-based it is likely that other bypasses will be discovered in the future...

47pages-keystone (>=0.0.1, <=0.0.5), @allbin/allbin-es6-api (>=3.0.11, <=4.0.0) +662 more potentially affected by unknown CVE via validator (>=3.1.0, <=3.33.0)

validator NPM version =3.1.0, =0.0.1, =3.0.11, =0.0.1, =1.0.0-beta.0, =1.0.1, =1.0.1, =0.0.1, =0.0.2, =0.3.21-3, =5.0.8, =0.3.1-integration, =0.3.1, =0.3.6 and more Source cves: unknown CVE Source advisory: MEND:WS-2017-0110...

Veritas: A Semantically Grounded Agentic Framework for Memory Corruption Vulnerability Detection in Binaries

Detecting memory corruption vulnerabilities in stripped binaries requires recovering object semantics, interprocedural propagation, and feasible triggers from low-level, lossy representations. Recent LLM-based approaches improve code understanding, but reliable detection still requires grounding ...

mcp-validator (0.1.1) potentially affected by CVE-2026-31245 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31245 Source advisory: OSV:GHSA-CGX8-QGVR-F7VF...

mcp-validator (0.1.1) potentially affected by CVE-2026-31240 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31240 Source advisory: OSV:GHSA-JFV9-68M5-GJJR...

mcp-validator (0.1.1) potentially affected by CVE-2026-31241 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31241 Source advisory: OSV:GHSA-GQ6F-QWV9-RF4J...

PT-2026-40120

Name of the Vulnerable Software and Affected Versions Guardrails AI versions prior to 0.6.8 Description A code injection issue exists in the Hub package installation mechanism. When installing validator packages using the command guardrails hub install, the system retrieves a manifest from the...

CVE-2026-31233

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

PT-2026-67782

The archive validator could accept certain malformed relative pointers and invalid ArchivedHashTable states. In particular, the hash table verifier did not ensure that the number of occupied buckets matched the table's declared length. A crafted archive could pass the checks performed by the safe...

Adversarial SQL Injection Generation with LLM-Based Architectures

SQL injection SQLi attacks are still one of the serious attacks ranked in the Open Worldwide Application Security Project OWASP Top 10 threats. Today, with advances in Artificial Intelligence AI, especially in Large Language Models LLMs, an opportunity has been created for automating adversarial...

GHSA-G8R3-5HWF-QP96 epa4all-client has a VAU Signature bypass

Impact In SignedPublicKeysTrustValidatorImpl.isTrusted, the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify. The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: OSV:GHSA-V39H-62P7-JPJC...

GHSA-RQV2-M695-F8J4 MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

Summary The public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go validateWebsiteURL only checks that the...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: OSV:GHSA-Q3J6-QGPJ-74H6...