Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-97736
Medium · 5.4
CWE-777 Sep 25, 2026
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is…
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
CVE-2026-22068
Medium · 5.3
CWE-777 Jul 29, 2026
Apache Traffic Server: Regex mappings match with malicious domain names
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-40110
High · 7.3
CWE-777 May 5, 2026
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
CVE-2026-39087
Medium · 6.4
CWE-777 Apr 23, 2026
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push…
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.