CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

AZL-92847 CVE-2026-26197 affecting package hdf5 for versions less than 1.14.6-4

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

CVE-2026-35198

HeyForm (open-source form builder) is affected by a stored XSS vulnerability present before version 3.0.0-rc.7. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, enabling complete account takeover through privilege escalation. A fix is av...

CVE-2026-35198 HeyForm vulnerable to stored XSS via form field titles

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

GHSA-P7HP-79JJ-Q923 Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6g9v-7gq3-p2c6. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE...

Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxg-5xmv-922m. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that...

Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6g9v-7gq3-p2c6. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE...

GHSA-8PR5-WPG9-2H74 Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxg-5xmv-922m. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that...

GHSA-9C3H-Q3PP-FW5X Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hv6h-hc26-q48p. This link is maintained to preserve external references. Original Description SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed throug...

Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hv6h-hc26-q48p. This link is maintained to preserve external references. Original Description SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed throug...

GHSA-J6MJ-V752-PP4X Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rw6-p7m8-63jp. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

CVE-2026-63738

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...