# CWE-185.

Every Advisory and CVE whose sources give the weakness CWE-185, newest first.

## Records, newest first

- [Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder](https://agentprime.io/advisories/CVE-2026-114653.md)
  `CVE-2026-114653` · CVE record: MongoDB C# Driver · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-185
- [follow-redirects sensitiveHeaders regex escaping can expose credential headers](https://agentprime.io/advisories/GHSA-8r9p-f939-6h3c.md)
  `GHSA-8r9p-f939-6h3c`, `CVE-2026-111755` · npm `follow-redirects`: affected `>=1.16.0, <1.16.1`, fixed in `1.16.1` · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, CWE-185
- [Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass](https://agentprime.io/advisories/GHSA-f8c7-rwf9-fmgm.md)
  `GHSA-f8c7-rwf9-fmgm`, `CVE-2026-111057` · PyPI `mercury`: affected `>=3.0.0, <3.2.4`, fixed in `3.2.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, CWE-185
- [GitHub CLI allows attestation verification bypass through unescaped regex metacharacters](https://agentprime.io/advisories/GHSA-mm27-mwq9-fr5g.md)
  `GHSA-mm27-mwq9-fr5g`, `CVE-2026-64655`, `GO-2026-6767` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 2.1 Low · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-185
- [Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field](https://agentprime.io/advisories/CVE-2026-54506.md)
  `CVE-2026-54506` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-185
- [Consul vulnerable to an authorization bypass in the Connect service mesh](https://agentprime.io/advisories/CVE-2026-88021.md)
  `CVE-2026-88021` · CVE record: HashiCorp Consul and 1 more · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-185
- [@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped](https://agentprime.io/advisories/GHSA-hp3v-mfqw-h74c.md)
  `GHSA-hp3v-mfqw-h74c`, `CVE-2026-73425` · npm `@astrojs/netlify`: affected `<8.1.2`, fixed in `8.1.2` · CVSS 3.7 Low · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-185
- [Webmin information disclosure via regex pattern](https://agentprime.io/advisories/CVE-2026-56021.md)
  `CVE-2026-56021` · CVE record: Webmin Webmin · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-185, CWE-777
- [Budibase: Unanchored Regex in \`matchers.ts\` Allows CSRF Bypass via Query String Injection in Budibase Worker](https://agentprime.io/advisories/GHSA-wxq7-x3qp-vcr8.md)
  `GHSA-wxq7-x3qp-vcr8`, `CVE-2026-48147` · npm `@budibase/backend-core`: affected `<3.35.4`, fixed in `3.35.4` · CVSS 6.5 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-185
- [Hono: IP Restriction bypasses static deny rules for non-canonical IPv6](https://agentprime.io/advisories/GHSA-xrhx-7g5j-rcj5.md)
  `GHSA-xrhx-7g5j-rcj5`, `CVE-2026-47674` · npm `hono`: affected `<4.12.21`, fixed in `4.12.21` · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-185, CWE-1289
- [Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection](https://agentprime.io/advisories/GHSA-72xp-p242-47p9.md)
  `GHSA-72xp-p242-47p9`, `CVE-2026-45065`, `PKSA-3f27-q682-kfn9`, `PKSA-yc7t-91v9-99xs` · Packagist `symfony/routing` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 2.3 Low · Not analysed yet · Published 27 May 2026 · Tags: Open redirect, CWE-185
- [Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass](https://agentprime.io/advisories/CVE-2026-4296.md)
  `CVE-2026-4296` · CVE record: GitHub Enterprise Server · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-185
- [Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching](https://agentprime.io/advisories/GHSA-rmx9-2pp3-xhcr.md)
  `GHSA-rmx9-2pp3-xhcr`, `CVE-2026-25542`, `GO-2026-5630` · Go `github.com/tektoncd/pipeline`: affected `>=0.43.0, <1.0.2 || >=1.2.0, <1.3.4 || >=1.4.0, <1.6.2 || >=1.7.0, <1.9.3 || >=1.10.0, <1.11.1`, fixed in `1.0.2`, `1.3.4`, `1.6.2`, `1.9.3`, `1.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-185
- [Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots](https://agentprime.io/advisories/GHSA-9gcg-w975-3rjh.md)
  `GHSA-9gcg-w975-3rjh`, `CVE-2026-39350`, `GO-2026-5289` · Go `istio.io/istio`: affected `>=0.0.0-20241024090207-0bf27d49ba4b, <0.0.0-20260403004500-692e460c342d`, fixed in `0.0.0-20260403004500-692e460c342d` · CVSS 5.4 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Broken access control, CWE-185
- [OpenClaw safeBins jq \`$ENV\` filter bypass allows environment variable disclosure](https://agentprime.io/advisories/GHSA-jccr-rrw2-vc8h.md)
  `GHSA-jccr-rrw2-vc8h`, `CVE-2026-41368` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 7.1 High · Not analysed yet · Published 31 Mar 2026 · Tags: Information disclosure, CWE-185
- [SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()](https://agentprime.io/advisories/GHSA-7j2x-32w6-p43p.md)
  `GHSA-7j2x-32w6-p43p`, `CVE-2026-33418` · npm `@dicebear/converter`: affected `<9.4.2`, fixed in `9.4.2` · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-185
- [league/commonmark has an embed extension allowed_domains bypass](https://agentprime.io/advisories/GHSA-hh8v-hgvp-g3f5.md)
  `GHSA-hh8v-hgvp-g3f5`, `CVE-2026-33347`, `PKSA-21fb-n1x5-5nf7` · Packagist `league/commonmark`: affected `>=2.3.0, <2.8.2`, fixed in `2.8.2` · CVSS 6.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF), CWE-185
- [LAM has incorrect regular expression in PDF export component that allows user to upload files of any type](https://agentprime.io/advisories/CVE-2026-27895.md)
  `CVE-2026-27895` · CVE record: LDAPAccountManager lam · CVSS 4.3 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-185
- [Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation](https://agentprime.io/advisories/GHSA-573f-x89g-hqp9.md)
  `GHSA-573f-x89g-hqp9`, `CVE-2026-3419` · npm `fastify`: affected `>=5.7.2, <5.8.1`, fixed in `5.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-185
- [fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names](https://agentprime.io/advisories/GHSA-m7jm-9gc2-mpf2.md)
  `GHSA-m7jm-9gc2-mpf2`, `CVE-2026-25896` · npm `fast-xml-parser`: affected `>=4.1.3, <4.5.4 || >=5.0.0, <5.3.5`, fixed in `4.5.4`, `5.3.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-185
- [Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns](https://agentprime.io/advisories/GHSA-93ph-p7v4-hwh4.md)
  `GHSA-93ph-p7v4-hwh4`, `CVE-2026-25479`, `PYSEC-2026-2196` · PyPI `litestar`: affected `>=2.19.0, <2.20.0`, fixed in `2.20.0` · CVSS 6.5 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-185
- [Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing](https://agentprime.io/advisories/GHSA-r354-f388-2fhh.md)
  `GHSA-r354-f388-2fhh`, `CVE-2026-24398` · npm `hono`: affected `<4.11.7`, fixed in `4.11.7` · CVSS 4.8 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-185
- [FastAPI Guard has a regex bypass](https://agentprime.io/advisories/GHSA-rrf6-pxg8-684g.md)
  `GHSA-rrf6-pxg8-684g`, `CVE-2025-54365`, `PYSEC-2026-1360` · PyPI `fastapi-guard`: affected `>=3.0.1, <3.0.2`, fixed in `3.0.2` · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2025 · Tags: Denial of service, CWE-20, CWE-185
- [Cisco Enterprise Chat and Email: A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could…](https://agentprime.io/advisories/CVE-2025-20139.md)
  `CVE-2025-20139` · CVE record: Cisco Cisco Enterprise Chat and Email · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-185
- [parse-uri Regular expression Denial of Service (ReDoS)](https://agentprime.io/advisories/GHSA-6fx8-h7jm-663j.md)
  `GHSA-6fx8-h7jm-663j`, `CVE-2024-36751` · npm `parse-uri` and 1 more: affected `<=1.0.9`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: Denial of service, CWE-185
- [authentik has an insecure default configuration for OAuth2 Redirect URIs](https://agentprime.io/advisories/CVE-2024-52289.md)
  `CVE-2024-52289` · CVE record: goauthentik authentik · CVSS 7.9 High · Not analysed yet · Published 21 Nov 2024 · Tags: CWE-185
- [Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)](https://agentprime.io/advisories/GHSA-mpcw-3j5p-p99x.md)
  `GHSA-mpcw-3j5p-p99x` · Maven `org.openrefine.dependencies:butterfly`: affected `<1.2.6`, fixed in `1.2.6` · No CVSS score · Not analysed yet · Published 24 Oct 2024 · Tags: Code injection, CWE-185
- [WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration](https://agentprime.io/advisories/CVE-2024-6641.md)
  `CVE-2024-6641` · CVE record: astrasecuritysuite WP Hardening (discontinued) · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: CWE-185
- [Incorrect Regular Expression in GravityZone Update Server (VA-11465)](https://agentprime.io/advisories/CVE-2024-2223.md)
  `CVE-2024-2223` · CVE record: Bitdefender GravityZone Control Center (On Premises) and 2 more · CVSS 8.1 High · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-185
- [Incorrect default pattern in Jenkins Audit Trail Plugin](https://agentprime.io/advisories/GHSA-7v9p-34r2-q668.md)
  `GHSA-7v9p-34r2-q668`, `CVE-2020-2288` · Maven `org.jenkins-ci.plugins:audit-trail`: affected `<3.7`, fixed in `3.7` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-185
- [Istio ReDoS Vulnerability](https://agentprime.io/advisories/GHSA-qcvw-82hh-gq38.md)
  `GHSA-qcvw-82hh-gq38`, `CVE-2019-14993` · Go `istio.io/istio`: affected `<1.1.13 || >=1.2.0, <1.2.4`, fixed in `1.1.13`, `1.2.4` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-185
- [Regular Expression Denial of Service (ReDoS) in braces](https://agentprime.io/advisories/GHSA-cwfw-4gq5-mrqx.md)
  `GHSA-cwfw-4gq5-mrqx`, `CVE-2018-1109` · npm `braces`: affected `>=2.2.0, <2.3.1`, fixed in `2.3.1` · No CVSS score · Not analysed yet · Published 6 Jan 2022 · Tags: Denial of service, CWE-185
- [DoS attack using PostMaster filters](https://agentprime.io/advisories/CVE-2021-36093.md)
  `CVE-2021-36093` · CVE record: OTRS AG ((OTRS)) Community Edition and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2021 · Tags: CWE-185
- [Incorrect Regular Expression in RestSharp](https://agentprime.io/advisories/GHSA-9pq7-rcxv-47vq.md)
  `GHSA-9pq7-rcxv-47vq`, `CVE-2021-27293` · NuGet `RestSharp`: affected `<106.11.8-alpha.0.13`, fixed in `106.11.8-alpha.0.13` · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2021 · Tags: CWE-185, CWE-697
- [Specially crafted regex query can cause DoS](https://agentprime.io/advisories/CVE-2020-7929.md)
  `CVE-2020-7929` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Mar 2021 · Tags: CWE-185
- [Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2020-3408.md)
  `CVE-2020-3408` · CVE record: Cisco Cisco IOS · CVSS 8.6 High · Not analysed yet · Published 24 Sept 2020 · Tags: CWE-185
- [Regular Expression Denial of Service in papaparse](https://agentprime.io/advisories/GHSA-qvjc-g5vr-mfgr.md)
  `GHSA-qvjc-g5vr-mfgr`, `CVE-2020-36649` · npm `papaparse`: affected `<5.2.0`, fixed in `5.2.0` · CVSS 3.5 Low · Not analysed yet · Published 4 Sept 2020 · Tags: Denial of service, CWE-185
- [Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion.](https://agentprime.io/advisories/CVE-2020-7016.md)
  `CVE-2020-7016` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 27 Jul 2020 · Tags: CWE-185
- [bypass of manageRedirect in GLPI](https://agentprime.io/advisories/CVE-2020-11034.md)
  `CVE-2020-11034` · CVE record: glpi-project GLPI · CVSS 6.1 Medium · Not analysed yet · Published 5 May 2020 · Tags: Open redirect, CWE-185
- [A flaw was found in openshift-ansible.](https://agentprime.io/advisories/CVE-2020-1741.md)
  `CVE-2020-1741` · CVE record: Red Hat openshift-ansible · CVSS 5.9 Medium · Not analysed yet · Published 24 Apr 2020 · Tags: CWE-185
- [Duplicate Advisory: Regular Expression Denial of Service in braces](https://agentprime.io/advisories/GHSA-g95f-p29q-9xw4.md)
  `GHSA-g95f-p29q-9xw4` · npm `braces`: affected `<2.3.1`, fixed in `2.3.1` · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 6 Jun 2019 · Tags: Denial of service, CWE-185
- [uap-core Regular Expression Denial of Service issue](https://agentprime.io/advisories/GHSA-fx7m-j728-mjw3.md)
  `GHSA-fx7m-j728-mjw3`, `CVE-2018-20164` · npm `uap-core`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Mar 2019 · Tags: CWE-185
- [Django denial-of-service possibility in urlize and urlizetrunc template filters](https://agentprime.io/advisories/GHSA-r28v-mw67-m5p9.md)
  `GHSA-r28v-mw67-m5p9`, `CVE-2018-7536`, `PYSEC-2018-5` · PyPI `django`: affected `>=1.8a1, <1.8.19 || >=1.11a1, <1.11.11 || >=2.0a1, <2.0.3`, fixed in `1.8.19`, `1.11.11`, `2.0.3` · CVSS 5.3 Medium · Not analysed yet · Published 4 Jan 2019 · Tags: CWE-185
- [Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters](https://agentprime.io/advisories/GHSA-2f9x-5v75-3qv4.md)
  `GHSA-2f9x-5v75-3qv4`, `CVE-2018-7537`, `PYSEC-2018-6` · PyPI `django`: affected `>=1.8, <1.8.19 || >=1.11, <1.11.11 || >=2.0, <2.0.3`, fixed in `1.8.19`, `1.11.11`, `2.0.3` · CVSS 5.3 Medium · Not analysed yet · Published 4 Jan 2019 · Tags: CWE-185
- [js-bson vulnerable to REDoS](https://agentprime.io/advisories/GHSA-8462-q7x7-g2x4.md)
  `GHSA-8462-q7x7-g2x4`, `CVE-2018-13863` · npm `bson`: affected `>=0.5.0, <1.0.5`, fixed in `1.0.5` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2018 · Tags: Denial of service, CWE-185
- [Mosca REDoS Vulnerability](https://agentprime.io/advisories/GHSA-wqg7-vrj7-v82h.md)
  `GHSA-wqg7-vrj7-v82h`, `CVE-2018-11615` · npm `mosca`: affected `<2.8.2`, fixed in `2.8.2` · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2018 · Tags: CWE-20, CWE-185
- [Regular Expression Denial of Service in sshpk](https://agentprime.io/advisories/GHSA-2m39-62fm-q8r3.md)
  `GHSA-2m39-62fm-q8r3`, `CVE-2018-3737` · npm `sshpk`: affected `<1.13.2`, fixed in `1.13.2` · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2018 · Tags: Denial of service, CWE-185
- [Node.js: The \`'path'\` module in the Node.js 4.x release line contains a potential regular…](https://agentprime.io/advisories/CVE-2018-7158.md)
  `CVE-2018-7158` · CVE record: The Node.js Project Node.js · No CVSS score · Not analysed yet · Published 17 May 2018 · Tags: CWE-185

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-185>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-185/>. Everything for agents: <https://agentprime.io/llms.txt>.