CWE-777 · weakness in Input Validation and Logic
Regular Expression without Anchors
6 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.
- Apache Traffic Server: Regex mappings match with malicious domain names
- Webmin information disclosure via regex pattern
- WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
- jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
- ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
- tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.