CWE-625 · weakness in Input Validation and Logic
Permissive Regular Expression
22 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.
- Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct priv…
- Keycloak: authorization bypass
- Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
- Auth Bypass in Google's Closure-Library
- AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
- Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/argum…
- OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization
- Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the aff…
- Permissive Regular Expression in GitLab
- CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. A…
- Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
- Astro: Netlify Image CDN allowlist bypass enables SSRF
- In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
- Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
- Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
- CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
- sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows…
- @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.