Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2178

GitHub issue published 1 week, 1 day ago

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

          Permalink
          
            CVE-2026-16277
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()
          
      https://access.redhat.com/security/cve/CVE-2026-16277
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2462085
    
    issue-trackingx_refsource_REDHAT
  
      https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c3454…
    
      https://www.linuxfromscratch.org/blfs/advisories/consolidated.html
    
    rpcbind

NIXPKGS-2026-2177

GitHub issue published 1 week, 1 day ago

xrdp: security issues < 0.10.6.1

Permalink CVE-2026-55639

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-6g36-mxcf-r3gc x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-54538

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9j3q-9mvw-qv7j x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-55645

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3m4m-h22g-c7xx x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-41521

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-v8w6-pf78-9458 x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-44178

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4 x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-55626

8.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: No authentication required with Xvnc backend on RHEL 9

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-44978

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-42218

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

XRDP is vulnerable to a server timing attack, leading to user enumeration

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3wr5-fwmh-qh34 x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-41252

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: lib_palette_update Heap Buffer Overflow & RCE

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-w5vg-6qmv-j63j x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

Permalink CVE-2026-55238

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package pulseaudio-module-xrdp 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-mg8j-x9rw-9xv3 x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC

xrdp

==< 0.10.6.1

NIXPKGS-2026-2176

GitHub issue published 1 week, 1 day ago

surrealdb: security issues < 3.1.5

Permalink CVE-2026-63738

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal

GitHub Security Advisory (GHSA-hv6h-hc26-q48p) vendor-advisory
VulnCheck Advisory: SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal third-party-advisory

surrealdb

<3.1.5
==3.1.5

Permalink CVE-2026-63737

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.5 Denial of Service via deep operator chains

GitHub Security Advisory (GHSA-jv2j-mqmw-xvv5) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.5 Denial of Service via deep operator chains third-party-advisory

surrealdb

<3.1.5
==3.1.5

Permalink CVE-2026-63739

8.3 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER

GitHub Security Advisory (GHSA-cc8f-fcx3-gpjr) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER third-party-advisory

surrealdb

<3.1.5
==3.1.5

Permalink CVE-2026-63740

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.4 Array Element Permission Bypass

GitHub Security Advisory (GHSA-8rw6-p7m8-63jp) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.4 Array Element Permission Bypass third-party-advisory

surrealdb

==3.1.4
<3.1.4

Permalink CVE-2026-63744

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.5 SSRF via JWKS URL Redirect

GitHub Security Advisory (GHSA-h5rg-8p7f-47g2) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.5 SSRF via JWKS URL Redirect third-party-advisory

surrealdb

<3.1.5
==3.1.5

NIXPKGS-2026-2175

GitHub issue published 1 week, 1 day ago

surrealdb: security issues < 3.2.0

Permalink CVE-2026-63734

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import

GitHub Security Advisory (GHSA-jwr6-6444-28xv) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import third-party-advisory

surrealdb

==3.2.0
<3.2.0

Permalink CVE-2026-63735

8.6 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.2.0 Authentication Bypass via Custom API

GitHub Security Advisory (GHSA-848m-r628-vrxw) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.2.0 Authentication Bypass via Custom API third-party-advisory

surrealdb

==3.2.0
<3.2.0

Permalink CVE-2026-63733

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause

GitHub Security Advisory (GHSA-66r2-5gwj-gxm2) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause third-party-advisory

surrealdb

==3.2.0
<3.2.0

Permalink CVE-2026-63736

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

GitHub Security Advisory (GHSA-5x4x-2946-qr67) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution third-party-advisory

surrealdb

==3.2.0
<3.2.0

NIXPKGS-2026-2174

GitHub issue published 1 week, 1 day ago

surrealdb: security issues < 3.1.0

Permalink CVE-2026-63760

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Denial of Service via JSON Parser

GitHub Security Advisory (GHSA-q729-696q-g9pq) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via JSON Parser third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63758

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Authorization Bypass via KILL Statement

GitHub Security Advisory (GHSA-gcwr-5mrf-fvch) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authorization Bypass via KILL Statement third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63750

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket

GitHub Security Advisory (GHSA-65rj-r9fh-jp2v) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63741

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Authentication Bypass via USE statement

GitHub Security Advisory (GHSA-wp87-mgvq-5j93) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authentication Bypass via USE statement third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63746

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Permission Bypass via Graph Traversal

GitHub Security Advisory (GHSA-vjjx-rfw4-rmfc) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Permission Bypass via Graph Traversal third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63748

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Information Disclosure via Error Messages

GitHub Security Advisory (GHSA-6g9v-7gq3-p2c6) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Information Disclosure via Error Messages third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63761

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Algorithm Downgrade via ES512

GitHub Security Advisory (GHSA-fwg2-gr34-q3w8) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Algorithm Downgrade via ES512 third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63749

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT

GitHub Security Advisory (GHSA-6wqw-vhfr-9999) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63745

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

GitHub Security Advisory (GHSA-6vg3-hgrw-p5gf) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63757

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

GitHub Security Advisory (GHSA-5qfp-32cf-69jh) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Session Hijacking via /rpc sessions third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63751

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch

GitHub Security Advisory (GHSA-fpxg-5xmv-922m) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63747

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Denial of Service via malformed RPC use

GitHub Security Advisory (GHSA-wjjj-24cx-f28g) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via malformed RPC use third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63753

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Authentication Bypass via LIVE Query

GitHub Security Advisory (GHSA-4m82-p8cx-f94j) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authentication Bypass via LIVE Query third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63756

9.2 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-migrations
- surrealdb-surrealkv
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition

GitHub Security Advisory (GHSA-4vgr-h27g-cf9p) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63754

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Denial of Service via LIVE Query

GitHub Security Advisory (GHSA-4v76-cw68-4vc9) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via LIVE Query third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63759

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-migrations
- surrealdb-surrealkv
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Denial of Service nested type annotations

GitHub Security Advisory (GHSA-q8qp-67f9-wr3f) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service nested type annotations third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63743

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
2 packages
- surrealdb-surrealkv
- surrealdb-migrations
1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse restored package surrealdb-surrealkv 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect

GitHub Security Advisory (GHSA-97vg-427p-8hx5) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63752

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 RELATE Statement Record Overwrite

GitHub Security Advisory (GHSA-f82j-v89j-mf86) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 RELATE Statement Record Overwrite third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63755

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

GitHub Security Advisory (GHSA-98fx-66cf-fc7c) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Permission Bypass via WHERE Clause third-party-advisory

surrealdb

==3.1.0
<3.1.0

Permalink CVE-2026-63742

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored package surrealdb-migrations 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT

GitHub Security Advisory (GHSA-c8jx-96c9-8xrp) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT third-party-advisory

surrealdb

==3.1.0
<3.1.0

NIXPKGS-2026-2173

GitHub issue published 1 week, 1 day ago

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

          Permalink
          
            CVE-2026-49997
          
        5.4 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                surrealdb-surrealkv
surrealdb-migrations

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
          
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-whwg-vh4f-pmmf
    
    x_refsource_CONFIRM
  
      https://github.com/surrealdb/surrealdb/commit/500f4060349580b9cbb9c07b8112a487551c4616
    
    x_refsource_MISC
  
      https://github.com/surrealdb/surrealdb/releases/tag/v3.1.0
    
    x_refsource_MISC
  
    surrealdb

            ==< 3.1.0

NIXPKGS-2026-2172

GitHub issue published 1 week, 2 days ago

OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection

          Permalink
          
            CVE-2026-5663
          
        7.3 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Not Defined (X)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                2 references
                
                      Submit #786061 | OFFIS DCMTK up to 3.7.…
                    
                      VDB-355486 | CTI Indicators (IOB, IOC, …
                    
          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
              maintainer @iimog
            
          1 week, 2 days ago
          
              maintainer.ignore
            
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
          
      VDB-355486 | OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
    
    technical-descriptionvdb-entry
  
      Submit #786061 | OFFIS DCMTK up to 3.7.0 OS Command Injection
    
    third-party-advisory
  
      https://machinespirits.com/advisory/2e1627/
    
    related
  
      https://support.dcmtk.org/redmine/issues/1194
    
    issue-tracking
  
      https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8
    
    patch
  
          Ignored references (1)
        
      VDB-355486 | CTI Indicators (IOB, IOC, TTP, IOA)
    
    permissions-requiredsignature
  
    DCMTK

            ==3.7.0
          
            ==3.1
          
            ==3.2
          
            ==3.3
          
            ==3.5
          
            ==3.6
          
            ==3.4
          
            ==3.0

NIXPKGS-2026-2171

GitHub issue published 1 week, 2 days ago

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected

Permalink CVE-2026-5090

updated 1 week, 2 days ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse accepted 1 week, 2 days ago
@LeSuisse published on GitHub 1 week, 2 days ago

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected

Template-Toolkit

=<3.102

NIXPKGS-2026-2170

GitHub issue published 2 weeks ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Permalink CVE-2026-15551

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 weeks ago
@LeSuisse ignored package libsForQt5.rlottie-qml 2 weeks ago
@LeSuisse accepted 2 weeks ago
@LeSuisse published on GitHub 2 weeks ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

https://github.com/Samsung/rlottie/pull/595

rlottie

==bf689b72b8482c5ea674235854bd11b6d1b42588

Patch: https://github.com/Samsung/rlottie/commit/f487eff2f8086b84ae1c7faa0418abec909e874b

NIXPKGS-2026-2169

GitHub issue published 2 weeks ago

Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block

          Permalink
          
            CVE-2026-60103
          
        6.8 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 weeks ago
          
            Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block
          
      Pull Request
    
    issue-tracking
  
      Patch Commit
    
    patch
  
      https://www.vulncheck.com/advisories/blender-out-of-bounds-read-via-crafted-ble…
    
    third-party-advisory
  
    blender

            ==968972a918b5ed2d534295b639c54449d7de11cd
          
            =<5.1.2