EUVD-2026-58110

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-14679

CVE-2026-14679 : PostgreSQL suffers a stack buffer overflow in argument name matching that can affect object creators through OUT parameter count. Affected versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 (and earlier). The attack writes 0x0 and 0x1 bytes to server memory. The descrip...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

PT-2026-71683

Name of the Vulnerable Software and Affected Versions Perl versions 5.9.4 through 5.41.8 Description Incorrect regular expression match results occur when a stale failure flag causes the Aho-Corasick prescan to end prematurely in the S find byclass function. The prescan identifies potential match...

CVE-2026-19487: Always-Incorrect Control Flow Implementation

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

CVE-2026-68421

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

EUVD-2026-55611

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, aft...

EUVD-2026-55607

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

CVE-2026-68421

The CVE-2026-68421 entry concerns the Linux kernel sched_ext path. The issue arises when put_prev_task_scx() warns about a runnable task dropping to a lower sched_class without ENQ_LAST, due to core scheduling forcing idle via an SMT sibling’s core_pick path which bypasses balance_one(). The miti...

CVE-2026-68421 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

PYSEC-2026-3635 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...