apk package
chainguard/py3.11-captum
pkg:apk/chainguard/py3.11-captum
Vulnerabilities (34)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-27904 | — | < 0.9.0-r1 | 0.9.0-r1 | Feb 26, 2026 | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh | ||
| CVE-2026-26996 | — | < 0.9.0-r1 | 0.9.0-r1 | Feb 20, 2026 | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact | ||
| CVE-2024-21538 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Nov 8, 2024 | Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted | |
| CVE-2024-4068 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | May 14, 2024 | The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program | |
| CVE-2024-4067 | Med | 5.3 | < 0.9.0-r1 | 0.9.0-r1 | May 14, 2024 | The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching w | |
| CVE-2023-44270 | Med | 5.3 | < 0.9.0-r1 | 0.9.0-r1 | Sep 29, 2023 | An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be inc | |
| CVE-2023-28155 | Med | 6.1 | < 0.9.0-r1 | 0.9.0-r1 | Mar 16, 2023 | The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintaine | |
| CVE-2022-3517 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Oct 17, 2022 | A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. | |
| CVE-2021-43307 | Med | 5.9 | < 0.9.0-r1 | 0.9.0-r1 | Jun 2, 2022 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method | |
| CVE-2021-42740 | Cri | 9.8 | < 0.9.0-r1 | 0.9.0-r1 | Oct 21, 2021 | The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi | |
| CVE-2021-3803 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | Sep 17, 2021 | nth-check is vulnerable to Inefficient Regular Expression Complexity | |
| CVE-2021-33623 | Hig | 7.5 | < 0.9.0-r1 | 0.9.0-r1 | May 28, 2021 | The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. | |
| CVE-2021-23364 | Med | 5.3 | < 0.9.0-r1 | 0.9.0-r1 | Apr 28, 2021 | The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. | |
| CVE-2021-23337 | Hig | 7.2 | < 0.9.0-r1 | 0.9.0-r1 | Feb 15, 2021 | Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. |
- CVE-2026-27904Feb 26, 2026affected < 0.9.0-r1fixed 0.9.0-r1
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh
- CVE-2026-26996Feb 20, 2026affected < 0.9.0-r1fixed 0.9.0-r1
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact
- affected < 0.9.0-r1fixed 0.9.0-r1
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted
- affected < 0.9.0-r1fixed 0.9.0-r1
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program
- affected < 0.9.0-r1fixed 0.9.0-r1
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching w
- affected < 0.9.0-r1fixed 0.9.0-r1
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be inc
- affected < 0.9.0-r1fixed 0.9.0-r1
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintaine
- affected < 0.9.0-r1fixed 0.9.0-r1
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
- affected < 0.9.0-r1fixed 0.9.0-r1
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
- affected < 0.9.0-r1fixed 0.9.0-r1
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command wi
- affected < 0.9.0-r1fixed 0.9.0-r1
nth-check is vulnerable to Inefficient Regular Expression Complexity
- affected < 0.9.0-r1fixed 0.9.0-r1
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
- affected < 0.9.0-r1fixed 0.9.0-r1
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
- affected < 0.9.0-r1fixed 0.9.0-r1
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Page 2 of 2