GHSA-F82J-V89J-MF86 SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission

RELATE creates an edge record between two existing records, and SurrealDB enforces the CREATE permission on the edge table for this operation. When the statement included a SET id = edge:existing clause, however, the new edge's id ended up pointing at an record that was already in storage. Rather...

SurrealDB has an Authorization Bypass via Composite Record-id Paths

An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entrie...

GHSA-6VG3-HGRW-P5GF SurrealDB has an Authorization Bypass via Composite Record-id Paths

An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entrie...

CVE-2026-13880

creationtimestamp| type| source ---|---|--- 2026-07-01 20:01:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmcnsupo222 2026-07-02 07:22:11+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13819

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmc2eecjz22 2026-07-02 07:19:45+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 11:41:27+00:00| seen|...

CVE-2026-13817

creationtimestamp| type| source ---|---|--- 2026-07-01 19:31:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmayj5ohn2q 2026-07-02 07:19:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:41+00:00| seen|...

MINI-36JH-XMVM-MRPH

Bulletin has no description...

MINI-8QXW-JVJF-WXVQ

Bulletin has no description...

MINI-F5RW-F9FF-RC37

Bulletin has no description...

MINI-8FFX-2M52-8G97

Bulletin has no description...

CVE-2025-36323

creationtimestamp| type| source ---|---|--- 2026-07-01 17:56:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm3o2pzsi24...

MINI-3CJC-3764-RQJC

Bulletin has no description...

MINI-F68Q-4PX9-HFMG

Bulletin has no description...

CVE-2026-34111

Guardian language-system passes the id GET parameter directly into a PHP exec call in speechmactext.php line 18 without sanitization: exec"php jobs/speechaudiomactext.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell...

CVE-2026-34109

Guardian language-system passes the id GET parameter directly into a PHP exec call in speech.php line 18 without sanitization: exec"php jobs/speechaudio.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell metacharacters...

CVE-2026-34110

Guardian language-system passes the id GET parameter directly into a PHP exec call in complexstart.php line 14 without sanitization: exec"php jobs/complex.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell metacharacters...

CVE-2026-34114

Guardian language-system passes the id GET parameter directly into a PHP exec call in translatetext.php line 18 without sanitization: exec"php jobs/translatetext.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell...

CVE-2026-34102

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in jobinfoget.php line 16: SELECT FROM jobs where input1 = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract database contents...

CVE-2026-34100

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...