CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-72834

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-72834: Exposure of Sensitive Information to an Unauthorized Actor

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

PT-2026-72003

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the plperl function when returning a tied hash. An attacker can execute arbitrary code as the operating system user running the database by crafting a malicious function body. Remediation Upgrade libpq to...

ALPINE-CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

AZL-95687 CVE-2026-14670 affecting package postgresql for versions less than 16.15-1

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

UBUNTU-CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

EUVD-2026-57837

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

PT-2026-71653

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An algorithmic complexity issue exists in the hash search function. A remote attacker can trigger a denial of service by sending a carefully constructed file list. This exploit leverages quadratic-time...

SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:3569-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3569-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

EUVD-2026-57102

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...