CVE-2026-63738 SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

CVE-2026-63738

SurrealDB 3.1.0 before 3.1.5 exposes a field-permission bypass when records are accessed via graph-edge or back-reference traversals. The root cause is failure to enforce field-level SELECT permissions during graph traversals, enabling users with table-level SELECT access to materialize records a...

CVE-2026-63738

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

EUVD-2026-45909

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

CVE-2026-63738 SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-63751: Incorrect Authorization

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

CVE-2026-63738: Incorrect Authorization

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

PT-2026-61558

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description A field-level SELECT permission bypass exists in indexed COUNT fast paths. This allows attackers to execute COUNT queries on indexed fields that have field-level SELECT restrictions, enabling them ...

PT-2026-61564

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

PT-2026-67328

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.15.1 Description The CookieJar component fails to preserve the host-only scope of response cookies that are set without a Domain attribute or with an empty one. Instead of marking these cookies as host-onl...

CVE-2026-63748: Generation of Error Message Containing Sensitive Information

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

PT-2026-61554

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.1.4 Description An issue exists where field-level SELECT permissions are not enforced when records are accessed via graph-edge or back-reference traversals. Users with table-level SELECT access can bypass...

PT-2026-61567

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

PT-2026-61643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the Linux kernel during a mode change in the team network driver. The function team change mode uses memset to clear team-ops before restoring dummy...

PT-2026-61556

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.4 Description Incorrect index handling during permission filtering allows attackers with record scope access to read array elements that should be restricted. This occurs when the system fails to properly enforc...

Linux Distros Unpatched Vulnerability : CVE-2026-64028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns everywhere...

Linux Distros Unpatched Vulnerability : CVE-2026-63916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-1951)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1951 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guar...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...