CWE-777 · 5 records
Regular Expression without Anchors
CVEs in this class
5 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2026-40110No exploit | jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_patjupyter · jupyter server · CWE-777 | High7.6 | — | 0.3% | May 5, 2026 |
27Monitor | CVE-2026-22068No exploit | Apache Traffic Server: Regex mappings match with malicious domain namesapache · traffic server · CWE-777 | Medium6.9 | — | 0.6% | Jul 29, 2026 |
25Monitor | CVE-2026-39087No exploit | ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.ntfy · ntfy · CWE-777 | Medium6.4 | — | 0.2% | Apr 23, 2026 |
21Monitor | CVE-2026-97736No exploit | tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.tinyauth · tinyauth · CWE-777 | Medium5.4 | — | 0.2% | Sep 25, 2026 |
0Monitor | CVE-2026-78191No exploit | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pagesCWE-777 | — | — | 0.4% | 5 days ago |
- CVE-2026-4011030Monitor
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
HighCVSS 7.6No exploitEPSS 0%jupyter · jupyter serverMay 5, 2026
- CVE-2026-2206827Monitor
Apache Traffic Server: Regex mappings match with malicious domain names
MediumCVSS 6.9No exploitEPSS 0%apache · traffic serverJul 29, 2026
- CVE-2026-3908725Monitor
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
MediumCVSS 6.4No exploitEPSS 0%ntfy · ntfyApr 23, 2026
- CVE-2026-9773621Monitor
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.
MediumCVSS 5.4No exploitEPSS 0%tinyauth · tinyauthSep 25, 2026
- CVE-2026-781910Monitor
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
No exploitEPSS 0%5 days ago