vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

CVE-2026-73556

### Summary The fix for `GHSA-rwxx-mrjm-wc2m` ("ReDoS via `structured_outputs.regex` compiled without timeout") wrapped

历史摘要 · 未重新核验 · GitHub Advisory

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.t...

CVE-2026-85062

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous

历史摘要 · 未重新核验 · NVD

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could all...

CVE-2026-84642

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without es

历史摘要 · 未重新核验 · NVD

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

### Impact Affected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all o

历史摘要 · 未重新核验 · GitHub Advisory

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims c...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 unt

历史摘要 · 未重新核验 · NVD

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production i...

CVE-2026-83606

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-bet

历史摘要 · 未重新核验 · NVD

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 unt

历史摘要 · 未重新核验 · OSV.dev

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

CVE-2026-83606

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-bet

历史摘要 · 未重新核验 · OSV.dev

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the...

CVE-2026-80206

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep

历史摘要 · 未重新核验 · GitHub Advisory

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachmen...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUr

历史摘要 · 未重新核验 · NVD

nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUr

历史摘要 · 未重新核验 · OSV.dev

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every aster...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URL

历史摘要 · 未重新核验 · NVD

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. ...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokeniz

历史摘要 · 未重新核验 · NVD

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply spe...

CVE-2026-66766

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vu

历史摘要 · 未重新核验 · NVD

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Fr...

CVE-2026-70656

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and

历史摘要 · 未重新核验 · NVD

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokeniz

历史摘要 · 未重新核验 · GitHub Advisory

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokeniz

历史摘要 · 未重新核验 · NVD

NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokeniz

历史摘要 · 未重新核验 · OSV.dev

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which comp...

CVE-2026-77082

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS)

历史摘要 · 未重新核验 · NVD

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experien...

CVE-2026-62317

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing

历史摘要 · 未重新核验 · NVD