EUVD-2026-45905

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

CVE-2026-63734

SurrealDB prior to 3.2.0 is affected by a denial-of-service vulnerability in the SurrealML header parser. Authenticated Owner‑role users can crash the server by uploading a malformed .surml file to the /ml/import endpoint. Malformed header fields (e.g., non-numeric input-dimensions) trigger unche...

CVE-2026-63734 SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

PT-2026-61555

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description An arbitrary file read issue exists in the DEFINE ANALYZER mapper filter. Database users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file...

PT-2026-61550

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A denial of service issue exists in the SurrealML header parser. Authenticated users with the Owner role can crash the server by uploading a malformed .surml file to the '/ml/import' endpoint. By...

PT-2026-61560

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system follows HTTP redirects without re-validating the redirect targets against network capabilities. Users with the Owner...

CVE-2026-63734: Improper Input Validation

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

CVE-2026-63744: Server-Side Request Forgery (SSRF)

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138 ksmbd: validate SID in parent security descriptor during ACL inheritance

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138 ksmbd: validate SID in parent security descriptor during ACL inheritance

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138

CVE-2026-64138 affects the ksmbd component in the Linux kernel, addressing a vulnerability in ACL inheritance where the Owner/Group SIDs from the NT Security Descriptor could be unsafe when retrieved from a parent directory. The fix introduces the helper smb_validate_ntsd_sid() to safely validate...

EUVD-2026-45823

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-53394 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When findorallocopenstateowner encounters an unconfirmed owner, it calls releaseopenowner and sets oo = NULL. Control then falls through past the if oo guard -...

CVE-2026-53394 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When findorallocopenstateowner encounters an unconfirmed owner, it calls releaseopenowner and sets oo = NULL. Control then falls through past the if oo guard -...

PT-2026-61455

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the Owner SID and Group SID within the NT Security Descriptor smb ntsd retrieved from the parent directory are not properly validated during ACL...

CVE-2025-71392

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...

CVE-2024-58362

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58358

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server...