PT-2026-71474

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A buffer over-read occurs in the picksplit function of th...

Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

SplitVec::extendfromslice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of those...

RUSTSEC-2026-0252 Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

SplitVec::extendfromslice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of those...

PT-2026-80709

SplitVec::extend from slice increments the logical length self.len before cloning the incoming elements into the reserved slots. If an element's Clone panics mid-fill, unwinding leaves self.len counting slots that were never initialized. A later safe read get, indexing, iter then reads one of tho...

CVE-2026-68163

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68163

The CVE-2026-68163 entry concerns Linux kernel memory management: device-private PMD handling in page_vma_mapped_walk() and related code paths. Root cause was improper handling of device-private PMD entries after adding device-private support, leading to cases where PMD entries with PFNs could be...

EUVD-2026-55549

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

Malicious code in sme-rko-finance-front-operations-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743 On require of the package, index.js loads bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments...

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...

CVE-2026-57827 — Updated!

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

NPM: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

NPM: node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript vulnerability discovered by ? in WordPress Npm re2 versions = 1.26.0...

GHSA-J4R3-HG7J-8CHG node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Summary re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. Buffer arguments reach the native layer verbatim — only strings are re-encoded into well-formed UTF-8 — so a Buffer whose last byte is a multi-byte lead promise...

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Summary re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. Buffer arguments reach the native layer verbatim — only strings are re-encoded into well-formed UTF-8 — so a Buffer whose last byte is a multi-byte lead promise...

CVE-2026-71498 node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

CVE-2026-71498 node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

PT-2026-68815

Name of the Vulnerable Software and Affected Versions node-re2 versions prior to 1.26.1 Description An out-of-bounds read exists when passing a Buffer whose final bytes form a truncated multi-byte UTF-8 sequence. The native binding fails to validate the remaining buffer size when decoding the fin...

PT-2026-68968

Summary re2 infers a character's byte length from its UTF-8 lead byte alone, with no bound on the bytes actually remaining in the input. Buffer arguments reach the native layer verbatim — only strings are re-encoded into well-formed UTF-8 — so a Buffer whose last byte is a multi-byte lead promise...