CWE-777 vulnerabilities

WebDyne versions from 2.031 up to but not including 3.022 contain a vulnerability where files with .psp anywhere in their name are executed as Perl pages due to a regular expression lacking an end anchor. This allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl scripts by requesting the file, bypassing simple extension checks.

CVE-2026-22068 is a high-severity vulnerability in Apache Traffic Server involving a regular expression without anchors. This flaw affects versions from 9.0.x through 9.2.14 and 10.0.x through 10.1.3. The issue is resolved in versions 9.2.15 and 10.1.4. The vulnerability has a CVSS score of 8.2, indicating a network exploitable flaw with high confidentiality impact but low integrity and no availability impact.

Jupyter Server versions 2.17.0 and earlier contain a vulnerability in the Origin header validation logic. The server uses Python's re.match() function with a pattern that is not fully anchored, allowing origins that start with a trusted domain but have additional characters appended to bypass CORS restrictions. This enables an attacker controlling such a domain to make unauthorized cross-origin requests to the Jupyter Server API. The issue is fixed in version 2.18.0.