These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-65069 is a vulnerability in Data::DisjointSet::Shared versions before 0.02 for Perl. The module creates a world-readable mmap backing file and opens it without proper permissions, allowing local users to access sensitive information. Affected products include Data::DisjointSet::Shared versions before 0.02 for Perl. The vulnerability class is related to improper file permissions and symlink follow [truncated]
CVE-2026-65068 is a vulnerability in Data::SpatialHash::Shared versions before 0.02 for Perl. The package creates a world-readable mmap backing file and opens it without proper permissions, allowing local users to read the IPC payloads stored in the world-readable segment. A pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open. This vulnerability affec [truncated]
CVE-2026-65067 is a vulnerability in Data::Intern::Shared versions before 0.02 for Perl. The package creates a world-readable mmap backing file and opens it without O_EXCL or O_NOFOLLOW. This allows any local user to read sensitive information stored in the shared segment. Local users may be able to read IPC payloads stored in the world-readable segment. A pre-planted file or symlink at the path can be us [truncated]
Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the ope [truncated]
CVE-2026-65064 is a vulnerability in Data::HashMap::Shared versions before 0.14 for Perl, allowing a local attacker to read IPC payloads stored in a world-readable segment and potentially win a pre-creation race or redirect the open. The vulnerability is caused by creating a world-readable mmap backing file in shm_generic.h with open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). Users of Data::HashMap::Share [truncated]
Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in radix.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the ope [truncated]
CVE-2026-65062 is a vulnerability in Data::SortedSet::Shared versions before 0.03 for Perl. The package creates a world-readable mmap backing file and opens it without O_EXCL or O_NOFOLLOW. This allows local users to read IPC payloads stored in the shared segment and potentially win a pre-creation race or redirect the open. Affected product deployments should be identified, and owners assigned for follow- [truncated]
CVE-2026-65061 is a vulnerability in Data::ReqRep::Shared versions before 0.05 for Perl. The package creates a world-readable mmap backing file and opens it without O_EXCL or O_NOFOLLOW. This allows any local user to read the IPC payloads stored in the world-readable segment. A pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open. The vulnerability has [truncated]
CVE-2026-64617 is a vulnerability in Data::PubSub::Shared versions before 0.07 for Perl. The package creates a world-readable mmap backing file and opens it without O_EXCL or O_NOFOLLOW. This allows local users to read IPC payloads and potentially win a pre-creation race or redirect the open. Users should be aware of this vulnerability and take necessary precautions.
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the ope [truncated]
Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in deque.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open si [truncated]
CVE-2026-64613 is a vulnerability in Data::Buffer::Shared versions before 0.05 for Perl. The package creates a world-readable mmap backing file and opens it without the O_NOFOLLOW flag. This allows any local user to read the IPC payloads stored in the shared segment. A pre-planted symlink at the path can redirect the open to another file. The vulnerability has a high defensive priority due to its potentia [truncated]
CVE-2026-59146 is a high-severity vulnerability in the Data::SpatialHash::Shared Perl module, allowing out-of-bounds reads and writes via unvalidated bucket, link, and free-list indices. A local attacker can exploit this vulnerability to corrupt memory or crash the process. The vulnerability is caused by a lack of validation in the sph_walk_cell and sph_alloc_slot functions. The attach-time validator sph_ [truncated]
CVE-2026-59144 is a critical vulnerability in Data::RingBuffer::Shared versions before 0.04 for Perl. The vulnerability allows a stack buffer overflow via an unvalidated elem_size in ring_read_seq. The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. A local peer that can write the backin [truncated]
CVE-2026-59143 is an out-of-bounds read vulnerability in Data::RoaringBitmap::Shared Perl versions before 0.02. The attach-time validator rb_validate_header checks header scalars and region layout against the file size but does not validate bucket contents. A local peer that can write the backing file can leave the header valid while poisoning a bucket, causing the next membership query to dereference a f [truncated]
CVE-2026-59142 is an out-of-bounds read vulnerability in Data::HashMap::Shared versions before 0.14 for Perl. The vulnerability allows a local peer to read adjacent memory or crash the process by poisoning a record's offset and length. The attach-time validator shm_validate_header checks the header scalars and region layout against the file size but does not validate the array contents. The shm_str_copy f [truncated]
CVE-2026-59141 is an out-of-bounds read vulnerability in Data::RadixTree::Shared Perl versions before 0.02. The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size but does not validate the node records it then trusts. A local peer that can write the backing file can leave the header valid while poisoning the node records, allowing a lookup to derefe [truncated]
A local user can exploit this vulnerability to read beyond the bounds of an array, potentially leading to information disclosure or a denial of service. The vulnerability exists due to insufficient validation of node indices in the rank and min/max query paths. Specifically, the attach-time validator ss_validate_header only bounds the root index against the node pool (node_capacity), but does not validate [truncated]
CVE-2026-59139 is an out-of-bounds read vulnerability in Data::ReqRep::Shared versions before 0.05 for Perl. The vulnerability allows a local peer to read adjacent memory or crash the process by poisoning a request slot's offset and length. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size but does not validate the array contents. The reqrep [truncated]