CWE-625
CWE-625 · 7 records · 4 with a public proof-of-concept
Records the NVD classes under CWE-625, highest CVSS first.
- HIGH 8.2CVE-2026-14814
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted user…
gitlab
- HIGH 7.5CVE-2026-120645public PoC
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default t…
- HIGH 7.5CVE-2026-120631public PoC
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescape…
- HIGH 7CVE-2026-123315
In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
- UNSCOREDCVE-2026-34157public PoC
Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands e…
- UNSCOREDCVE-2026-118995
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation …
- UNSCOREDCVE-2026-102983public PoC
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates…