CWE-185 Incorrect Regular Expression

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

league/commonmark has an embed extension allowed_domains bypass

SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

Duplicate Advisory: Regular Expression Denial of Service in braces

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

parse-uri Regular expression Denial of Service (ReDoS)

FastAPI Guard has a regex bypass

Regular Expression Denial of Service in papaparse

Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

Django denial-of-service possibility in urlize and urlizetrunc template filters

Apache Libcloud vulnerable to certificate impersonation

Incorrect default pattern in Jenkins Audit Trail Plugin

Mosca REDoS Vulnerability

js-bson vulnerable to REDoS