[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-26996":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":34,"duplicate_of":9,"upstream":36,"downstream":37,"duplicates":134,"related":135,"reserved_at":9,"published_at":168,"modified_at":169,"state":170,"summary":171,"references_raw":179,"kevs":205,"epss":206,"epss_history":209,"metrics":484,"affected":498},"CVE-2026-26996","minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.","weakness","Draft","Base","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-492","Regular Expression Exponential Blowup",[],[25],{"_key":26,"name":27,"source":28,"url":29,"maturity":30,"reliability_score":31,"verified":32,"type":9,"platforms":33,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_ISAACS_MINIMATCH","Minimatch","github","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","poc",0.3,false,[],[35],"GHSA-3ppc-4f35-3m26",[],[38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,130,132],{"_key":39},"SUSE-SU-2026:20973-1",{"_key":41},"SUSE-SU-2026:20967-1",{"_key":43},"SUSE-SU-2026:1232-1",{"_key":45},"SUSE-SU-2026:20997-1",{"_key":47},"OPENSUSE-SU-2026:20464-1",{"_key":49},"OPENSUSE-SU-2026:20469-1",{"_key":51},"SUSE-SU-2026:1251-1",{"_key":53},"SUSE-SU-2026:1250-1",{"_key":55},"SUSE-SU-2026:1249-1",{"_key":57},"SUSE-SU-2026:21022-1",{"_key":59},"SUSE-SU-2026:21023-1",{"_key":61},"SUSE-SU-2026:21024-1",{"_key":63},"SUSE-SU-2026:21111-1",{"_key":65},"SUSE-SU-2026:21141-1",{"_key":67},"SUSE-SU-2026:21166-1",{"_key":69},"SUSE-SU-2026:21167-1",{"_key":71},"SUSE-SU-2026:21168-1",{"_key":73},"SUSE-SU-2026:21191-1",{"_key":75},"OPENSUSE-SU-2026:20502-1",{"_key":77},"OPENSUSE-SU-2026:20503-1",{"_key":79},"OPENSUSE-SU-2026:20504-1",{"_key":81},"OPENSUSE-SU-2026:20532-1",{"_key":83},"SUSE-SU-2026:21246-1",{"_key":85},"SUSE-SU-2026:21245-1",{"_key":87},"SUSE-SU-2026:21253-1",{"_key":89},"SUSE-SU-2026:21241-1",{"_key":91},"SUSE-SU-2026:21256-1",{"_key":93},"UBUNTU-CVE-2026-26996",{"_key":95},"DEBIAN-CVE-2026-26996",{"_key":97},"OPENSUSE-SU-2026:11126-1",{"_key":99},"OPENSUSE-SU-2026:11178-1",{"_key":101},"OPENSUSE-SU-2026:21266-1",{"_key":103},"RHSA-2026:13508",{"_key":105},"RHSA-2026:18054",{"_key":107},"RHSA-2026:18055",{"_key":109},"RHSA-2026:24761",{"_key":111},"RHSA-2026:7080",{"_key":113},"RHSA-2026:7123",{"_key":115},"RHSA-2026:7302",{"_key":117},"RHSA-2026:7310",{"_key":119},"RHSA-2026:7350",{"_key":121},"RHSA-2026:7670",{"_key":123},"RHSA-2026:7675",{"_key":125},"RHSA-2026:7896",{"_key":127},"RHSA-2026:7983",{"_key":129},"RHSA-2026:8339",{"_key":131},"RHSA-2026:9711",{"_key":133},"RHSA-2026:9874",[],[136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"_key":39},{"_key":41},{"_key":43},{"_key":45},{"_key":47},{"_key":49},{"_key":51},{"_key":53},{"_key":55},{"_key":57},{"_key":59},{"_key":61},{"_key":63},{"_key":65},{"_key":67},{"_key":69},{"_key":71},{"_key":73},{"_key":75},{"_key":77},{"_key":79},{"_key":81},{"_key":83},{"_key":85},{"_key":87},{"_key":89},{"_key":91},{"_key":97},{"_key":99},{"_key":101},{"_key":167},"CGA-4MRR-CGVH-9W95","2026-02-20T03:05:21.105Z","2026-02-20T15:34:15.151Z","Analyzed",{"cisa_kev":32,"cisa_ransomware":32,"cisa_vendor":9,"epss_severity":172,"epss_score":173,"severity":174,"severity_score":175,"severity_version":176,"severity_source":177,"severity_vector":178,"severity_status":170},"low",0.00519,"high",8.7,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",[180,189,195,200],{"url":29,"sources":181,"tags":184},[177,182,183],"nvd","osv_npm",[185,186,187,188],"X Refsource CONFIRM","Exploit","Vendor Advisory","WEB",{"url":190,"sources":191,"tags":192},"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",[177,182,183],[193,194,188],"X Refsource MISC","Patch",{"url":196,"sources":197,"tags":198},"https://nvd.nist.gov/vuln/detail/CVE-2026-26996",[183],[199],"Advisory",{"url":201,"sources":202,"tags":203},"https://github.com/isaacs/minimatch",[183],[204],"PACKAGE",[],{"date":207,"score":173,"percentile":208},"2026-07-05",0.40302,[210,214,218,221,224,227,230,234,237,240,243,246,249,252,255,258,261,264,267,270,273,276,279,282,285,288,290,293,296,299,303,306,309,313,316,319,321,324,327,330,333,336,339,343,346,349,352,355,358,361,364,367,370,373,376,379,382,385,388,391,394,397,400,403,406,409,412,415,418,422,425,428,431,434,437,440,443,446,449,452,455,458,461,464,467,470,473,476,478,481],{"date":211,"score":212,"percentile":213},"2026-02-20",0.00042,0.12864,{"date":215,"score":216,"percentile":217},"2026-02-21",0.0004,0.12096,{"date":219,"score":216,"percentile":220},"2026-02-22",0.12093,{"date":222,"score":216,"percentile":223},"2026-02-23",0.12068,{"date":225,"score":216,"percentile":226},"2026-02-24",0.1199,{"date":228,"score":216,"percentile":229},"2026-02-25",0.1193,{"date":231,"score":232,"percentile":233},"2026-02-26",0.00052,0.16142,{"date":235,"score":232,"percentile":236},"2026-02-27",0.16159,{"date":238,"score":232,"percentile":239},"2026-02-28",0.16163,{"date":241,"score":232,"percentile":242},"2026-03-01",0.16191,{"date":244,"score":232,"percentile":245},"2026-03-02",0.16123,{"date":247,"score":232,"percentile":248},"2026-03-03",0.16082,{"date":250,"score":232,"percentile":251},"2026-03-04",0.16037,{"date":253,"score":232,"percentile":254},"2026-03-05",0.16058,{"date":256,"score":232,"percentile":257},"2026-03-06",0.16055,{"date":259,"score":232,"percentile":260},"2026-03-07",0.16057,{"date":262,"score":232,"percentile":263},"2026-03-08",0.16023,{"date":265,"score":232,"percentile":266},"2026-03-09",0.15992,{"date":268,"score":232,"percentile":269},"2026-03-10",0.15984,{"date":271,"score":232,"percentile":272},"2026-03-11",0.16007,{"date":274,"score":232,"percentile":275},"2026-03-12",0.1607,{"date":277,"score":232,"percentile":278},"2026-03-13",0.16098,{"date":280,"score":232,"percentile":281},"2026-03-14",0.16103,{"date":283,"score":232,"percentile":284},"2026-03-15",0.16042,{"date":286,"score":232,"percentile":287},"2026-03-16",0.16006,{"date":289,"score":232,"percentile":269},"2026-03-17",{"date":291,"score":232,"percentile":292},"2026-03-18",0.15994,{"date":294,"score":232,"percentile":295},"2026-03-19",0.16013,{"date":297,"score":232,"percentile":298},"2026-03-20",0.16077,{"date":300,"score":301,"percentile":302},"2026-03-21",0.00017,0.03942,{"date":304,"score":301,"percentile":305},"2026-03-22",0.03934,{"date":307,"score":301,"percentile":308},"2026-03-23",0.03933,{"date":310,"score":311,"percentile":312},"2026-03-24",0.00018,0.04557,{"date":314,"score":311,"percentile":315},"2026-03-25",0.04594,{"date":317,"score":311,"percentile":318},"2026-03-26",0.04629,{"date":320,"score":311,"percentile":318},"2026-03-27",{"date":322,"score":311,"percentile":323},"2026-03-28",0.04632,{"date":325,"score":311,"percentile":326},"2026-03-29",0.04625,{"date":328,"score":311,"percentile":329},"2026-03-30",0.04603,{"date":331,"score":311,"percentile":332},"2026-03-31",0.04579,{"date":334,"score":311,"percentile":335},"2026-04-01",0.04597,{"date":337,"score":311,"percentile":338},"2026-04-02",0.04658,{"date":340,"score":341,"percentile":342},"2026-04-03",0.00025,0.06683,{"date":344,"score":341,"percentile":345},"2026-04-04",0.06717,{"date":347,"score":341,"percentile":348},"2026-04-05",0.06715,{"date":350,"score":341,"percentile":351},"2026-04-06",0.06682,{"date":353,"score":341,"percentile":354},"2026-04-07",0.06701,{"date":356,"score":341,"percentile":357},"2026-04-08",0.0675,{"date":359,"score":341,"percentile":360},"2026-04-09",0.06784,{"date":362,"score":341,"percentile":363},"2026-04-10",0.06798,{"date":365,"score":341,"percentile":366},"2026-04-11",0.06785,{"date":368,"score":341,"percentile":369},"2026-04-12",0.06778,{"date":371,"score":341,"percentile":372},"2026-04-13",0.06771,{"date":374,"score":341,"percentile":375},"2026-04-14",0.06688,{"date":377,"score":341,"percentile":378},"2026-04-15",0.06698,{"date":380,"score":341,"percentile":381},"2026-04-16",0.06702,{"date":383,"score":341,"percentile":384},"2026-04-17",0.06712,{"date":386,"score":341,"percentile":387},"2026-04-18",0.06694,{"date":389,"score":341,"percentile":390},"2026-04-19",0.06673,{"date":392,"score":341,"percentile":393},"2026-04-20",0.06657,{"date":395,"score":341,"percentile":396},"2026-04-21",0.06851,{"date":398,"score":341,"percentile":399},"2026-04-22",0.06847,{"date":401,"score":341,"percentile":402},"2026-04-23",0.06877,{"date":404,"score":341,"percentile":405},"2026-04-24",0.06857,{"date":407,"score":341,"percentile":408},"2026-04-25",0.06888,{"date":410,"score":341,"percentile":411},"2026-04-26",0.06878,{"date":413,"score":341,"percentile":414},"2026-04-27",0.06868,{"date":416,"score":341,"percentile":417},"2026-04-28",0.0684,{"date":419,"score":420,"percentile":421},"2026-04-29",0.00026,0.07178,{"date":423,"score":420,"percentile":424},"2026-04-30",0.07185,{"date":426,"score":420,"percentile":427},"2026-05-01",0.07167,{"date":429,"score":420,"percentile":430},"2026-05-02",0.07218,{"date":432,"score":420,"percentile":433},"2026-05-03",0.07205,{"date":435,"score":420,"percentile":436},"2026-05-04",0.07183,{"date":438,"score":420,"percentile":439},"2026-05-05",0.0719,{"date":441,"score":420,"percentile":442},"2026-05-06",0.07216,{"date":444,"score":420,"percentile":445},"2026-05-07",0.07345,{"date":447,"score":420,"percentile":448},"2026-05-08",0.07364,{"date":450,"score":420,"percentile":451},"2026-05-09",0.07417,{"date":453,"score":420,"percentile":454},"2026-05-10",0.07414,{"date":456,"score":420,"percentile":457},"2026-05-11",0.07396,{"date":459,"score":420,"percentile":460},"2026-05-12",0.0741,{"date":462,"score":420,"percentile":463},"2026-05-13",0.07413,{"date":465,"score":420,"percentile":466},"2026-05-14",0.07445,{"date":468,"score":420,"percentile":469},"2026-05-15",0.07443,{"date":471,"score":420,"percentile":472},"2026-05-16",0.07462,{"date":474,"score":420,"percentile":475},"2026-05-17",0.07453,{"date":477,"score":420,"percentile":460},"2026-05-18",{"date":479,"score":420,"percentile":480},"2026-05-19",0.07381,{"date":482,"score":420,"percentile":483},"2026-05-20",0.07371,[485,488,496],{"source":177,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":486},{"baseScore":175,"baseSeverity":487,"vectorString":178,"impactScore":9,"exploitabilityScore":9},"HIGH",{"source":182,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":489,"cvss_v4_0":494},{"baseScore":490,"baseSeverity":487,"vectorString":491,"impactScore":492,"exploitabilityScore":493},7.5,"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",6,10,{"baseScore":175,"baseSeverity":487,"vectorString":495,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":183,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":497},{"baseScore":175,"baseSeverity":9,"vectorString":178,"impactScore":9,"exploitabilityScore":9},[499,509,547],{"ecosystem":9,"name":500,"vendor":501,"product":500,"cpe_part":502,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":503},"minimatch","isaacs","a",[504],{"version":505,"is_range":506,"range_type":177,"version_start":9,"version_start_type":9,"version_end":507,"version_end_type":508,"fixed_in":9},"\u003C 10.2.1",true,"10.2.1","excluding",{"ecosystem":9,"name":500,"vendor":510,"product":500,"cpe_part":502,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":511},"minimatch_project",[512,515,520,524,528,532,536,540,544],{"version":513,"is_range":506,"range_type":514,"version_start":9,"version_start_type":9,"version_end":507,"version_end_type":508,"fixed_in":9},"lt10.2.1","cpe",{"version":516,"is_range":506,"range_type":514,"version_start":517,"version_start_type":518,"version_end":519,"version_end_type":508,"fixed_in":9},"gte3.0.0_lt3.1.3","3.0.0","including","3.1.3",{"version":521,"is_range":506,"range_type":514,"version_start":522,"version_start_type":518,"version_end":523,"version_end_type":508,"fixed_in":9},"gte4.0.0_lt4.2.4","4.0.0","4.2.4",{"version":525,"is_range":506,"range_type":514,"version_start":526,"version_start_type":518,"version_end":527,"version_end_type":508,"fixed_in":9},"gte5.0.0_lt5.1.7","5.0.0","5.1.7",{"version":529,"is_range":506,"range_type":514,"version_start":530,"version_start_type":518,"version_end":531,"version_end_type":508,"fixed_in":9},"gte6.0.0_lt6.2.1","6.0.0","6.2.1",{"version":533,"is_range":506,"range_type":514,"version_start":534,"version_start_type":518,"version_end":535,"version_end_type":508,"fixed_in":9},"gte7.0.0_lt7.4.7","7.0.0","7.4.7",{"version":537,"is_range":506,"range_type":514,"version_start":538,"version_start_type":518,"version_end":539,"version_end_type":508,"fixed_in":9},"gte8.0.0_lt8.0.5","8.0.0","8.0.5",{"version":541,"is_range":506,"range_type":514,"version_start":542,"version_start_type":518,"version_end":543,"version_end_type":508,"fixed_in":9},"gte9.0.0_lt9.0.6","9.0.0","9.0.6",{"version":545,"is_range":506,"range_type":514,"version_start":546,"version_start_type":518,"version_end":507,"version_end_type":508,"fixed_in":9},"gte10.0.0_lt10.2.1","10.0.0",{"ecosystem":548,"name":500,"vendor":548,"product":500,"cpe_part":9,"purl_type":549,"purl_namespace":9,"purl_name":500,"source":9,"versions":550},"Npm","npm",[551,554,556,558,560,562,564,566,568],{"version":552,"is_range":506,"range_type":553,"version_start":9,"version_start_type":9,"version_end":507,"version_end_type":508,"fixed_in":9},"lt10_2_1","semver",{"version":555,"is_range":506,"range_type":553,"version_start":546,"version_start_type":518,"version_end":507,"version_end_type":508,"fixed_in":9},"gte10_0_0_lt10_2_1",{"version":557,"is_range":506,"range_type":553,"version_start":542,"version_start_type":518,"version_end":543,"version_end_type":508,"fixed_in":9},"gte9_0_0_lt9_0_6",{"version":559,"is_range":506,"range_type":553,"version_start":538,"version_start_type":518,"version_end":539,"version_end_type":508,"fixed_in":9},"gte8_0_0_lt8_0_5",{"version":561,"is_range":506,"range_type":553,"version_start":534,"version_start_type":518,"version_end":535,"version_end_type":508,"fixed_in":9},"gte7_0_0_lt7_4_7",{"version":563,"is_range":506,"range_type":553,"version_start":530,"version_start_type":518,"version_end":531,"version_end_type":508,"fixed_in":9},"gte6_0_0_lt6_2_1",{"version":565,"is_range":506,"range_type":553,"version_start":526,"version_start_type":518,"version_end":527,"version_end_type":508,"fixed_in":9},"gte5_0_0_lt5_1_7",{"version":567,"is_range":506,"range_type":553,"version_start":522,"version_start_type":518,"version_end":523,"version_end_type":508,"fixed_in":9},"gte4_0_0_lt4_2_4",{"version":569,"is_range":506,"range_type":553,"version_start":9,"version_start_type":9,"version_end":519,"version_end_type":508,"fixed_in":9},"lt3_1_3"]