CVE-2026-125063

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

EUVD-2026-120159

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

CVE-2026-125063 Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

CVE-2026-125063

A vulnerability exists in the automation controller (specifically Red Hat Ansible Automation Platform 2 ) due to a quadratic regex complexity flaw in the rrule validation of schedules. The issue occurs when non-anchored regular expressions with lazy wildcard prefixes are applied to user-supplied ...

PT-2026-140937

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

CVE-2026-125063: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the rrule validation of schedules in automation controller

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

CLEANSTART-2024-SS93140 When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely

Security vulnerability affects the firefox-esr package. When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely...

Exploit for CVE-2026-109618

PHP2Shell: CVE-2026-109618 / CVE-2026-109619 PHP RCE Source Au...

CLSA-2026-1792162013 TuxCare security update for @vitest/web-worker (1 CVE)

TuxCare rebuilt @vitest/web-worker to address 1 CVE. Fixed in 3.2.4-tuxcare.4...

CLSA-2026-1792162011 TuxCare security update for @vitest/web-worker (2 CVEs)

TuxCare rebuilt @vitest/web-worker to address 2 CVEs. Fixed in 3.2.4-tuxcare.2...

CLSA-2026-1792160965 TuxCare security update for @vitest/web-worker (1 CVE)

TuxCare rebuilt @vitest/web-worker to address 1 CVE. Fixed in 3.2.4-tuxcare.3...

PT-2026-123695

TuxCare rebuilt @vitest/web-worker to address 1 CVE. Fixed in 3.2.4-tuxcare.3...

PT-2026-124478

TuxCare rebuilt @vitest/web-worker to address 2 CVEs. Fixed in 3.2.4-tuxcare.2...

PT-2026-124479

TuxCare rebuilt @vitest/web-worker to address 1 CVE. Fixed in 3.2.4-tuxcare.4...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller-container: automation-controller: automation-controller: server-side request forgery via the Thycotic Secret Server external credential plugin test endpoint (caller-controlled server_url, backend executed in the controller web process)

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the...

CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987: Use of Externally-Controlled Input to Select Classes or Code

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

Malicious code in @finaxis/common-js (npm)

Source: amazon-inspector f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308 Package is published with a README copied from lodash v4.18.1 and keywords 'lodash','lodash-js', but the sole shipped module dist/common-js.js is a heavily obfuscated bundle javascript-obfuscator with...