PT-2026-71423

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the '/api/v1/node-custom-function' endpoint can escape the sandbox by providing...

Vulnerability in contrib module (CVE-2026-15742)

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...

Vulnerability in core server (CVE-2026-18024)

PostgreSQL ascii function reads past end of buffer Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less...

Vulnerability in contrib module (CVE-2026-14673)

PostgreSQL amcheck does not clear untrusted search path Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before...

CVE-2026-16455: Improper Neutralization of CRLF Sequences

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

RHEL 8 : dracut (RHSA-2026:54575)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54575 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual...

RHEL 10 : dracut (RHSA-2026:54576)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54576 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtua...

CVE-2026-18024: Buffer Over-read

Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.1...

CVE-2026-14670: Heap-based Buffer Overflow

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

Vulnerability in core server (CVE-2026-14669)

PostgreSQL tochar heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQ...

CVE-2026-14673: Untrusted Search Path

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

RHEL 9 : dracut (RHSA-2026:54571)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54571 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual...

CVE-2026-73649: Improper Control of Generation of Code

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...

CVE-2026-72809

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

CVE-2026-73268

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Security update for dracut

This update for dracut fixes the following issue: Update to version 055+suse.367.g85633e8. Securitys issue fixed: CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: Fixbase: sanitize message writt...