Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
Regex Denial of Service in youtube-regex npm package through version 1.0.5.
Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and cr
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker
A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.
A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to ineff
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnera
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><article class="result-card svelte-e12qt1"><div class="card-header svelte-e12qt1"><a class="cve-id svelte-e12qt1" href="/cve/CVE-2025-66305">CVE-2025-66305</a> <div class="card-badges svelte-e12qt1"><span class="badge svelte-eex7hx" data-variant="severity-medium"><!---->MEDIUM<!----></span><!----> <!--[0--><span class="cvss-chip svelte-e12qt1">CVSS 6.9</span><!--]--> <!--[-1--><!--]--></div> <a class="btn-similar svelte-e12qt1" href="/search?similarTo=CVE-2025-66305">Find Similar <svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><line x1="5" y1="12" x2="19" y2="12" class="svelte-e12qt1"></line><polyline points="12 5 19 12 12 19" class="svelte-e12qt1"></polyline></svg></a></div> <div class="card-desc svelte-e12qt1"><!---->Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><a class="vendor-chip svelte-e12qt1" href="/affected-products?vendor=getgrav">getgrav</a><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><article class="result-card svelte-e12qt1"><div class="card-header svelte-e12qt1"><a class="cve-id svelte-e12qt1" href="/cve/CVE-2026-10692">CVE-2026-10692</a> <div class="card-badges svelte-e12qt1"><span class="badge svelte-eex7hx" data-variant="severity-low"><!---->LOW<!----></span><!----> <!--[0--><span class="cvss-chip svelte-e12qt1">CVSS 2.1</span><!--]--> <!--[-1--><!--]--></div> <a class="btn-similar svelte-e12qt1" href="/search?similarTo=CVE-2026-10692">Find Similar <svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><line x1="5" y1="12" x2="19" y2="12" class="svelte-e12qt1"></line><polyline points="12 5 19 12 12 19" class="svelte-e12qt1"></polyline></svg></a></div> <div class="card-desc svelte-e12qt1"><!---->A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argume<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><article class="result-card svelte-e12qt1"><div class="card-header svelte-e12qt1"><a class="cve-id svelte-e12qt1" href="/cve/CVE-2025-3264">CVE-2025-3264</a> <div class="card-badges svelte-e12qt1"><span class="badge svelte-eex7hx" data-variant="severity-none"><!---->NONE<!----></span><!----> <!--[-1--><!--]--> <!--[-1--><!--]--></div> <a class="btn-similar svelte-e12qt1" href="/search?similarTo=CVE-2025-3264">Find Similar <svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><line x1="5" y1="12" x2="19" y2="12" class="svelte-e12qt1"></line><polyline points="12 5 19 12 12 19" class="svelte-e12qt1"></polyline></svg></a></div> <div class="card-desc svelte-e12qt1"><!---->A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. Thi<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><a class="vendor-chip svelte-e12qt1" href="/affected-products?vendor=huggingface">huggingface</a><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><article class="result-card svelte-e12qt1"><div class="card-header svelte-e12qt1"><a class="cve-id svelte-e12qt1" href="/cve/CVE-2025-1194">CVE-2025-1194</a> <div class="card-badges svelte-e12qt1"><span class="badge svelte-eex7hx" data-variant="severity-medium"><!---->MEDIUM<!----></span><!----> <!--[0--><span class="cvss-chip svelte-e12qt1">CVSS 6.5</span><!--]--> <!--[-1--><!--]--></div> <a class="btn-similar svelte-e12qt1" href="/search?similarTo=CVE-2025-1194">Find Similar <svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><line x1="5" y1="12" x2="19" y2="12" class="svelte-e12qt1"></line><polyline points="12 5 19 12 12 19" class="svelte-e12qt1"></polyline></svg></a></div> <div class="card-desc svelte-e12qt1"><!---->A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japane<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><a class="vendor-chip svelte-e12qt1" href="/affected-products?vendor=huggingface">huggingface</a><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><article class="result-card svelte-e12qt1"><div class="card-header svelte-e12qt1"><a class="cve-id svelte-e12qt1" href="/cve/CVE-2025-3263">CVE-2025-3263</a> <div class="card-badges svelte-e12qt1"><span class="badge svelte-eex7hx" data-variant="severity-none"><!---->NONE<!----></span><!----> <!--[-1--><!--]--> <!--[-1--><!--]--></div> <a class="btn-similar svelte-e12qt1" href="/search?similarTo=CVE-2025-3263">Find Similar <svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><line x1="5" y1="12" x2="19" y2="12" class="svelte-e12qt1"></line><polyline points="12 5 19 12 12 19" class="svelte-e12qt1"></polyline></svg></a></div> <div class="card-desc svelte-e12qt1"><!---->A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.c<!----></div> <div class="card-meta-row svelte-e12qt1"><div class="card-vendors-inline svelte-e12qt1"><!--[--><a class="vendor-chip svelte-e12qt1" href="/affected-products?vendor=huggingface">huggingface</a><!--]--></div> <div class="footer-meta svelte-e12qt1"><span class="source-tag svelte-e12qt1"><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="svelte-e12qt1"><polyline points="20 6 9 17 4 12" class="svelte-e12qt1"></polyline></svg> NVD</span> <span class="rrf-score svelte-e12qt1">RRF 0.013</span></div></div></article><!--]--></div> <!--[0--><div class="pagination-row svelte-e12qt1"><!--[-1--><!--]--> <span class="page-info svelte-e12qt1">Page 1+</span> <!--[0--><a class="btn-page btn-page-next svelte-e12qt1" href="/search?similarTo=CVE-2024-9506&offset=20">Next →</a><!--]--></div><!--]--><!--]--></div><!--]--><!----></main></div></div> <div class="toast-region svelte-1fk2ial" aria-live="polite" aria-atomic="false"><!--[--><!--]--></div><!----><!--]--><!--]--> <!--[-1--><!--]--><!--]-->
<script>
{
__sveltekit_4pw80m = {
base: new URL(".", location).pathname.slice(0, -1)
};
const element = document.currentScript.parentElement;
Promise.all([
import("./_app/immutable/entry/start.ZUc-Dm9j.js"),
import("./_app/immutable/entry/app.CmNRmdYL.js")
]).then(([kit, app]) => {
kit.start(app, element, {
node_ids: [0, 11],
data: [null,{type:"data",data:{formState:{query:"",severity:[],vendor:[],cwe:[],kev:false,minCvss:"",publishedSince:"",similarTo:"CVE-2024-9506",offset:0},results:{results:[{cveId:"CVE-2024-9506",score:.01639344262295082,severity:"LOW",cvssBase:3.7,kevListed:false,epssPercentile:.39405,publishedAt:"2024-10-15T16:15:06.650Z",vendors:[],snippet:"Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability."},{cveId:"CVE-2025-5897",score:.016129032258064516,severity:"MEDIUM",cvssBase:5.3,kevListed:false,epssPercentile:.38834,publishedAt:"2025-06-09T21:15:47.707Z",vendors:["vuejs"],snippet:"A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of"},{cveId:"CVE-2024-36751",score:.015873015873015872,severity:"MEDIUM",cvssBase:6.5,kevListed:false,epssPercentile:.39452,publishedAt:"2025-01-15T22:15:26.400Z",vendors:[],snippet:"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL."},{cveId:"CVE-2025-24981",score:.015625,severity:"CRITICAL",cvssBase:9.3,kevListed:false,epssPercentile:.45743,publishedAt:"2025-02-06T18:15:32.847Z",vendors:[],snippet:"MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript "},{cveId:"CVE-2024-21729",score:.015384615384615385,severity:"MEDIUM",cvssBase:6.1,kevListed:false,epssPercentile:.3536,publishedAt:"2024-07-09T17:15:14.463Z",vendors:["joomla"],snippet:"Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field."},{cveId:"CVE-2025-54476",score:.015151515151515152,severity:"MEDIUM",cvssBase:4.8,kevListed:false,epssPercentile:.20988,publishedAt:"2025-09-30T16:15:52.280Z",vendors:[],snippet:"Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class."},{cveId:"CVE-2025-65122",score:.014925373134328358,severity:"HIGH",cvssBase:7.5,kevListed:false,epssPercentile:.1958,publishedAt:"2026-05-07T16:16:17.810Z",vendors:[],snippet:"Regex Denial of Service in youtube-regex npm package through version 1.0.5."},{cveId:"CVE-2024-21539",score:.014705882352941176,severity:"HIGH",cvssBase:7.5,kevListed:false,epssPercentile:.37945,publishedAt:"2024-11-19T05:15:16.453Z",vendors:[],snippet:"Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and cr"},{cveId:"CVE-2026-2327",score:.014492753623188406,severity:"MEDIUM",cvssBase:5.5,kevListed:false,epssPercentile:.3919,publishedAt:"2026-02-12T06:16:02.243Z",vendors:["markdown-it_project"],snippet:"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker"},{cveId:"CVE-2025-54295",score:.014285714285714285,severity:"MEDIUM",cvssBase:5.1,kevListed:false,epssPercentile:.22653,publishedAt:"2025-07-23T12:15:28.370Z",vendors:[],snippet:"A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered."},{cveId:"CVE-2025-5895",score:.014084507042253521,severity:"LOW",cvssBase:2.1,kevListed:false,epssPercentile:.39157,publishedAt:"2025-06-09T20:15:25.890Z",vendors:["metabase"],snippet:"A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to ineff"},{cveId:"CVE-2025-3933",score:.013888888888888888,severity:"MEDIUM",cvssBase:5.3,kevListed:false,epssPercentile:.34519,publishedAt:"2025-07-11T10:15:22.293Z",vendors:["huggingface"],snippet:"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnera"},{cveId:"CVE-2025-3262",score:.0136986301369863,severity:"HIGH",cvssBase:7.5,kevListed:false,epssPercentile:.34436,publishedAt:"2025-07-07T10:15:27.200Z",vendors:["huggingface"],snippet:"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular "},{cveId:"CVE-2026-48903",score:.013513513513513514,severity:"MEDIUM",cvssBase:6.9,kevListed:false,epssPercentile:.04033,publishedAt:"2026-05-26T17:16:55.077Z",vendors:["joomla"],snippet:"Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components."},{cveId:"CVE-2024-51434",score:.013333333333333334,severity:"MEDIUM",cvssBase:6.1,kevListed:false,epssPercentile:.26357,publishedAt:"2024-11-07T22:15:21.467Z",vendors:[],snippet:"Inconsistent \u003Cplaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier."},{cveId:"CVE-2025-66305",score:.013157894736842105,severity:"MEDIUM",cvssBase:6.9,kevListed:false,epssPercentile:.24938,publishedAt:"2025-12-01T22:15:50.250Z",vendors:["getgrav"],snippet:"Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the \"Languages\" submenu of the Grav admin configuration panel (/admin/config/system"},{cveId:"CVE-2026-10692",score:.012987012987012988,severity:"LOW",cvssBase:2.1,kevListed:false,epssPercentile:.22668,publishedAt:"2026-06-03T00:16:31.143Z",vendors:[],snippet:"A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argume"},{cveId:"CVE-2025-3264",score:.01282051282051282,severity:"NONE",cvssBase:null,kevListed:false,epssPercentile:.34519,publishedAt:"2025-07-07T10:15:27.500Z",vendors:["huggingface"],snippet:"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. Thi"},{cveId:"CVE-2025-1194",score:.012658227848101266,severity:"MEDIUM",cvssBase:6.5,kevListed:false,epssPercentile:.30293,publishedAt:"2025-04-29T12:15:31.717Z",vendors:["huggingface"],snippet:"A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japane"},{cveId:"CVE-2025-3263",score:.0125,severity:"NONE",cvssBase:null,kevListed:false,epssPercentile:.34519,publishedAt:"2025-07-07T10:15:27.350Z",vendors:["huggingface"],snippet:"A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.c"}],truncated:true}},uses:{search_params:["q","similarTo","severity","vendor","cwe","kev","minCvss","publishedSince","offset","product","epss"]}}],
form: null,
error: null
});
});
}
</script>
</div>
</body>
</html>