PT-2026-91917

PCRE2 before 10.48 allows a pcre2 dfa match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check even though a newly allocated block, for the same purpose, does have a size check. This outcome requires an attacker-controlled...

CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

EUVD-2026-70698

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CLSA-2026-1788424971 rsyslog: Fix of CVE-2026-19654

CVE-2026-19654: imptcp: guard regex framing match at line start...

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

Impact When a filer JWT restricts a token to a set of path prefixes via allowedprefixes, the authorization check used a literal byte-prefix match strings.HasPrefix. A token scoped to /tenant1 therefore also authorized requests to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup...

GHSA-GV5W-HFX8-8CWQ SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

Impact When a filer JWT restricts a token to a set of path prefixes via allowedprefixes, the authorization check used a literal byte-prefix match strings.HasPrefix. A token scoped to /tenant1 therefore also authorized requests to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup...

BIT-SEAWEEDFS-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

CLSA-2026-1788262732 Fix CVE(s): CVE-2026-19654

SECURITY UPDATE: denial of service in the optional imptcp module: a regex match at offset zero after oversize-frame recovery submits a negative message length and crashes rsyslogd - debian/patches/CVE-2026-19654.patch: denial of service in the optional imptcp module: a regex match at offset zero...

CVE-2026-82749 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent... scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent... resolves that expression against the parent record...

CVE-2026-82749

CVE-2026-82749 is an Incorrect Authorization flaw in ash-project ash (versions 3.13.2 through 3.32.1 ). The vulnerable component is resolve_parent_in_filter/3 in lib/ash/actions/read/relationships.ex, which resolved unresolvable parent(...) references to nil instead of raising an error. This caus...

EEF-CVE-2026-82749 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Summary Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent... scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent... resolves that expression against the parent...

CVE-2026-82749 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent... scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent... resolves that expression against the parent record...

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...