Monthly
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.
Rack::Sendfile in versions prior to 2.2.23, 3.1.21, and 3.2.6 allows remote attackers to inject regex metacharacters into X-Accel-Mapping request headers, enabling unescaped interpolation that manipulates the X-Accel-Redirect response header and causes nginx to serve unintended files from internal locations. No public exploit code or active exploitation has been confirmed; patch versions are available from the vendor.
Execution allowlist bypass in OpenClaw (versions prior to 2026.3.11) enables unauthenticated remote attackers to execute arbitrary commands by exploiting improper pattern normalization in matchesExecAllowlistPattern. The vulnerability stems from lowercasing and overly permissive glob matching logic that incorrectly allows the ? wildcard to match across POSIX path segments, circumventing intended security restrictions. No public exploit identified at time of analysis, though CVSS 8.8 severity reflects network-accessible attack vector with no authentication required and high integrity/availability impact.
External control of critical state data in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive information to remote unauthenticated attackers via network-accessible state manipulation. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability degradation, per CVSS; no public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Privilege escalation in Red Hat Advanced Cluster Security 4 (StackRox Central) allows authenticated OIDC token holders to gain unauthorized role assignments through unanchored regular expression matching in the Machine-to-Machine token exchange subsystem. When administrators configure M2M role mappings, RHACS matches incoming OIDC claim values against configured patterns without regex anchors, meaning an attacker whose claim value is a superstring of a mapped pattern - for example, 'superadmin' matching a pattern intended only for 'admin' - receives elevated roles unintentionally. No public exploit code or active exploitation has been identified at this time; the CVSS AC:H rating reflects a genuine complexity barrier requiring attacker knowledge of the target's role mapping configuration.
Rack web server interface versions prior to 2.2.23, 3.1.21, and 3.2.6 fail to properly escape regex metacharacters when constructing directory path filtering expressions, causing the Rack::Directory component to expose full filesystem paths in HTML directory listings. An unauthenticated remote attacker can retrieve sensitive path information by requesting directory listings when the configured root path contains regex special characters such as +, *, or ., achieving low-confidentiality impact with CVSS 5.3. No public exploit code or active exploitation has been confirmed at time of analysis.
Privilege escalation in Azure Compute Gallery's regex validation enables high-privileged local users to gain unauthorized system access on affected Microsoft and ACI Confidential Containers systems. An authenticated attacker with elevated permissions can exploit the permissive pattern matching to bypass security controls and achieve full system compromise. No patch is currently available, making this a medium-severity risk for environments running vulnerable versions.
A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.
Rack::Sendfile in versions prior to 2.2.23, 3.1.21, and 3.2.6 allows remote attackers to inject regex metacharacters into X-Accel-Mapping request headers, enabling unescaped interpolation that manipulates the X-Accel-Redirect response header and causes nginx to serve unintended files from internal locations. No public exploit code or active exploitation has been confirmed; patch versions are available from the vendor.
Execution allowlist bypass in OpenClaw (versions prior to 2026.3.11) enables unauthenticated remote attackers to execute arbitrary commands by exploiting improper pattern normalization in matchesExecAllowlistPattern. The vulnerability stems from lowercasing and overly permissive glob matching logic that incorrectly allows the ? wildcard to match across POSIX path segments, circumventing intended security restrictions. No public exploit identified at time of analysis, though CVSS 8.8 severity reflects network-accessible attack vector with no authentication required and high integrity/availability impact.
External control of critical state data in Dell Secure Connect Gateway (SCG) 5.0 exposes sensitive information to remote unauthenticated attackers via network-accessible state manipulation. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability degradation, per CVSS; no public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Privilege escalation in Red Hat Advanced Cluster Security 4 (StackRox Central) allows authenticated OIDC token holders to gain unauthorized role assignments through unanchored regular expression matching in the Machine-to-Machine token exchange subsystem. When administrators configure M2M role mappings, RHACS matches incoming OIDC claim values against configured patterns without regex anchors, meaning an attacker whose claim value is a superstring of a mapped pattern - for example, 'superadmin' matching a pattern intended only for 'admin' - receives elevated roles unintentionally. No public exploit code or active exploitation has been identified at this time; the CVSS AC:H rating reflects a genuine complexity barrier requiring attacker knowledge of the target's role mapping configuration.
Rack web server interface versions prior to 2.2.23, 3.1.21, and 3.2.6 fail to properly escape regex metacharacters when constructing directory path filtering expressions, causing the Rack::Directory component to expose full filesystem paths in HTML directory listings. An unauthenticated remote attacker can retrieve sensitive path information by requesting directory listings when the configured root path contains regex special characters such as +, *, or ., achieving low-confidentiality impact with CVSS 5.3. No public exploit code or active exploitation has been confirmed at time of analysis.
Privilege escalation in Azure Compute Gallery's regex validation enables high-privileged local users to gain unauthorized system access on affected Microsoft and ACI Confidential Containers systems. An authenticated attacker with elevated permissions can exploit the permissive pattern matching to bypass security controls and achieve full system compromise. No patch is currently available, making this a medium-severity risk for environments running vulnerable versions.
A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.