Skip to content
Noroxi

CWE-185 · 37 records

Incorrect Regular Expression

CVEs in this class

37 records

  • CVE-2019-12798
    39Monitor

    An issue was discovered in Artifex MuJS 1.0.5.

    CriticalCVSS 9.8No exploitEPSS 2%

    artifex · mujsJun 13, 2019

  • CVE-2024-2223
    39Monitor

    Incorrect Regular Expression in GravityZone Update Server (VA-11465)

    CriticalCVSS 9.8No exploitEPSS 1%

    bitdefender · endpoint securityApr 9, 2024

  • CVE-2026-25896
    37Monitor

    fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

    CriticalCVSS 9.3No exploitEPSS 1%

    naturalintelligence · fast-xml-parserFeb 20, 2026

  • CVE-2026-27895
    35Monitor

    LAM has incorrect regular expression in PDF export component that allows user to upload files of any type

    HighCVSS 8.8No exploitEPSS 1%

    ldap-account-manager · ldap account managerMar 17, 2026

  • CVE-2020-3408
    34Monitor

    Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability

    HighCVSS 8.6No exploitEPSS 2%

    cisco · iosSep 24, 2020

  • CVE-2018-17984
    32Monitor

    An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code executi

    HighCVSS 7.8No exploitEPSS 3%

    ispconfig · ispconfigOct 4, 2018

  • CVE-2018-7158
    31Monitor

    The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector.

    HighCVSS 7.5No exploitEPSS 3%

    nodejs · node.jsMay 17, 2018

  • CVE-2018-20801
    31Monitor

    In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a den

    HighCVSS 7.5No exploitEPSS 3%

    highcharts · highchartsMar 14, 2019

  • CVE-2019-14993
    31Monitor

    Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JW

    HighCVSS 7.5No exploitEPSS 2%

    istio · istioAug 13, 2019

  • CVE-2024-52289
    31Monitor

    authentik has an insecure default configuration for OAuth2 Redirect URIs

    HighCVSS 7.9No exploitEPSS 1%

    goauthentik · authentikNov 21, 2024

  • CVE-2026-4296
    30Monitor

    Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

    HighCVSS 7.5No exploitEPSS 1%

    github · enterprise serverApr 21, 2026

  • CVE-2025-20139
    30Monitor

    A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause

    HighCVSS 7.5No exploitEPSS 1%

    cisco · enterprise chat and emailApr 2, 2025

  • CVE-2026-33418
    30Monitor

    @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection

    HighCVSS 7.5No exploitEPSS 0%

    dicebear · dicebearMar 24, 2026

  • CVE-2026-88021
    28Monitor

    Consul vulnerable to an authorization bypass in the Connect service mesh

    HighCVSS 7.1No exploitEPSS 0%

    hashicorp · consulSep 10, 2026

  • CVE-2026-56021
    27Monitor

    Webmin information disclosure via regex pattern

    MediumCVSS 6.9No exploitEPSS 0%

    webmin · webminJun 18, 2026

  • CVE-2020-11034
    26Monitor

    bypass of manageRedirect in GLPI

    MediumCVSS 6.1Proof of conceptEPSS 8%

    glpi-project · glpiMay 5, 2020

  • CVE-2020-7929
    26Monitor

    Specially crafted regex query can cause DoS

    MediumCVSS 6.5No exploitEPSS 1%

    mongodb · mongodbMar 1, 2021

  • CVE-2026-25479
    26Monitor

    Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

    MediumCVSS 6.5No exploitEPSS 0%

    litestar · litestarFeb 9, 2026

  • CVE-2026-25542
    26Monitor

    Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

    MediumCVSS 6.5No exploitEPSS 0%

    linuxfoundation · tekton pipelinesApr 21, 2026

  • CVE-2026-24398
    26Monitor

    Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

    MediumCVSS 6.5No exploitEPSS 0%

    hono · honoJan 27, 2026

  • CVE-2026-48147
    26Monitor

    Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

    MediumCVSS 6.5No exploitEPSS 0%

    budibase · budibaseMay 27, 2026

  • CVE-2020-1741
    23Monitor

    A flaw was found in openshift-ansible.

    MediumCVSS 5.9No exploitEPSS 1%

    redhat · openshift container platformApr 24, 2020

  • CVE-2018-7536
    22Monitor

    An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.

    MediumCVSS 5.3No exploitEPSS 5%

    canonical · ubuntu linuxMar 9, 2018

  • CVE-2018-7537
    22Monitor

    An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.

    MediumCVSS 5.3No exploitEPSS 4%

    canonical · ubuntu linuxMar 9, 2018

  • CVE-2018-20164
    22Monitor

    An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0.

    MediumCVSS 5.3No exploitEPSS 3%

    uaparser · user agent parser-coreFeb 13, 2019

All vulnerability classes