CWE-185 · Input Validation and Logic
Incorrect Regular Expression
37CVEs
SortMost likely exploited
37 CVEs with CWE-185 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-7536An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inpu…Djangoproject · Django · 2018-03-09 | – | 4.6% | 2018-03-09 |
| CVE-2018-7537An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=T…Djangoproject · Django · 2018-03-09 | – | 4.4% | 2018-03-09 |
| CVE-2018-7158The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and…The Node.js Project · Node.js · 2018-05-17 | – | 3.5% | 2018-05-17 |
| CVE-2018-17984An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticate…Ispconfig · Ispconfig · 2018-10-04 | – | 3.4% | 2018-10-04 |
| CVE-2018-20164An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overlo…Uaparser · User Agent Parser-Core · 2019-02-13 | – | 3.3% | 2019-02-13 |
| CVE-2018-20801In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRe…Highcharts · Highcharts · 2019-03-14 | – | 3.2% | 2019-03-14 |
| CVE-2019-14993Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding,…Istio · Istio · 2019-08-13 | – | 2.3% | 2019-08-13 |
| CVE-2019-12798An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syntax list size.Artifex · Mujs · 2019-06-13 | – | 1.7% | 2019-06-13 |
| CVE-2020-3408Cisco IOS and IOS XE Software Split DNS Denial of Service VulnerabilityCisco · Cisco IOS · CVSS 8.6 · 2020-09-24 | 8.6 | 1.6% | 2020-09-24 |
| CVE-2018-1109A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) atta…Braces Project · nodejs-braces · 2021-03-30 | – | 1.4% | 2021-03-30 |
| CVE-2020-7929Specially crafted regex query can cause DoSMongoDB Inc. · MongoDB Server · CVSS 6.5 · 2021-03-01 | 6.5 | 1.3% | 2021-03-01 |
| CVE-2021-36093DoS attack using PostMaster filtersOTRS AG · ((OTRS)) Community Edition · CVSS 5.3 · 2021-09-06 | 5.3 | 1.1% | 2021-09-06 |
| CVE-2024-52289authentik has an insecure default configuration for OAuth2 Redirect URIsgoauthentik · authentik · CVSS 7.9 · 2024-11-21 | 7.9 | 1.1% | 2024-11-21 |
| CVE-2020-7016Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kiban…Elastic · Kibana · 2020-07-27 | – | 1.1% | 2020-07-27 |
| CVE-2020-1741A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, abl…Red Hat · openshift-ansible · CVSS 5.9 · 2020-04-24 | 5.9 | 0.9% | 2020-04-24 |
| CVE-2025-54365fastapi-guard patch contains bypassable RegExrennf93 · fastapi-guard · CVSS 7.8 · 2025-07-23 | 7.8 | 0.9% | 2025-07-23 |
| CVE-2026-111057Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmljar · mercury · CVSS 10 · 2026-10-19 | 10.0 | 0.7% | 2026-10-19 |
| CVE-2025-20139A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. T…Cisco · Cisco Enterprise Chat and Email · CVSS 7.5 · 2025-04-02 | 7.5 | 0.7% | 2025-04-02 |
| CVE-2026-25896fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesNaturalIntelligence · fast-xml-parser · CVSS 9.3 · 2026-02-20 | 9.3 | 0.5% | 2026-02-20 |
| CVE-2024-2223Incorrect Regular Expression in GravityZone Update Server (VA-11465)Bitdefender · GravityZone Control Center (On Premises) · CVSS 8.1 · 2024-04-09 | 8.1 | 0.5% | 2024-04-09 |
| CVE-2026-27895LAM has incorrect regular expression in PDF export component that allows user to upload files of any typeLDAPAccountManager · lam · CVSS 4.3 · 2026-03-17 | 4.3 | 0.5% | 2026-03-17 |
| CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirects · follow-redirects · CVSS 8.2 · 2026-10-19 | 8.2 | 0.5% | 2026-10-19 |
| CVE-2026-4296Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypassGitHub · Enterprise Server · CVSS 7.5 · 2026-04-21 | 7.5 | 0.4% | 2026-04-21 |
| CVE-2026-33418@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injectiondicebear · dicebear · CVSS 7.5 · 2026-03-24 | 7.5 | 0.4% | 2026-03-24 |
| CVE-2026-3419Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validationfastify · fastify · CVSS 5.3 · 2026-03-06 | 5.3 | 0.4% | 2026-03-06 |
| CVE-2024-6641WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumerationastrasecuritysuite · WP Hardening (discontinued) · CVSS 5.3 · 2024-09-18 | 5.3 | 0.4% | 2024-09-18 |
| CVE-2026-25479Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patternslitestar-org · litestar · CVSS 6.5 · 2026-02-09 | 6.5 | 0.4% | 2026-02-09 |
| CVE-2026-45065Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injectionsymfony · symfony · CVSS 2.3 · 2026-07-14 | 2.3 | 0.3% | 2026-07-14 |
| CVE-2026-64655GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matchingcli · cli · CVSS 2.1 · 2026-08-06 | 2.1 | 0.3% | 2026-08-06 |
| CVE-2026-24398Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofinghonojs · hono · CVSS 4.8 · 2026-01-27 | 4.8 | 0.3% | 2026-01-27 |
| CVE-2026-88021Consul vulnerable to an authorization bypass in the Connect service meshHashiCorp · Consul · CVSS 7.5 · 2026-09-10 | 7.5 | 0.3% | 2026-09-10 |
| CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escapedwithastro · astro · CVSS 3.7 · 2026-08-12 | 3.7 | 0.3% | 2026-08-12 |
| CVE-2026-25542Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matchingtektoncd · pipeline · CVSS 6.5 · 2026-04-21 | 6.5 | 0.3% | 2026-04-21 |
| CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6honojs · hono · CVSS 5.3 · 2026-05-28 | 5.3 | 0.2% | 2026-05-28 |
| CVE-2026-39350Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypassistio · istio · CVSS 5.4 · 2026-04-15 | 5.4 | 0.2% | 2026-04-15 |
| CVE-2026-114653Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderMongoDB · C# Driver · CVSS 6.5 · 2026-10-22 | 6.5 | 0.2% | 2026-10-22 |
| CVE-2026-48147Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase WorkerBudibase · budibase · CVSS 6.5 · 2026-05-27 | 6.5 | 0.1% | 2026-05-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.