CVE-2026-47276 NULL Pointer Dereference in REST API properties_parse via Malformed user_properties

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen is call...

CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2026-32825

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-persistence-jpa-json (>=3.0.0-m0, <=3.0.16) +7 more potentially affected by CVE-2026-57308 via org.apache.syncope.core:syncope-core-persistence-jpa (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.core:syncope-core-persistence-jpa MAVEN version =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-57308 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-19352541...

CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only "POST /api/v1/send" with "http.MaxBytesReader"...

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

GHSA-M464-HJ36-96VX Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...

Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...

GHSA-8PR5-WPG9-2H74 Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxg-5xmv-922m. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that...

Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxg-5xmv-922m. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that...

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63761

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 DEFINE ACCESS ... TYPE JWT ALGORITHM ES512, because the underlying jsonwebtoken crate v10.x has no ES512 variant and the mapping defaults to ES384 without any error, warning...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

CVE-2026-63761 SurrealDB before 3.1.0 Algorithm Downgrade via ES512

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 DEFINE ACCESS ... TYPE JWT ALGORITHM ES512, because the underlying jsonwebtoken crate v10.x has no ES512 variant and the mapping defaults to ES384 without any error, warning...

EUVD-2026-45932

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 DEFINE ACCESS ... TYPE JWT ALGORITHM ES512, because the underlying jsonwebtoken crate v10.x has no ES512 variant and the mapping defaults to ES384 without any error, warning...

CVE-2026-63761

SurrealDB before 3.1.0 uses JWT ES512 but internally maps to ES384 because jsonwebtoken v10.x has no ES512. This causes authentication handshake failures when a P-521 key for ES512 is used and can lead to tokens being rejected by systems expecting genuine ES512 signatures. The vulnerability descr...

EUVD-2026-45931

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63760

SurrealDB prior to 3.1.0 fails to enforce recursion depth limits in its value/JSON parsers when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON to the WebSocket /rpc endpoint to exhaust server memory and crash the process. Remediation deta...