918 matches found
CVE-2026-121418
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...
CVE-2026-121418
SurrealDB versions 3.1.0 before 3.3.0 are vulnerable to an incorrect authorization vulnerability in the streaming index planner . The issue allows users to infer restricted field values because the planner utilizes indexes on fields that have restrictive SELECT permissions . Specifically, an atta...
EUVD-2026-115950
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...
CVE-2026-121418 SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...
CVE-2026-121418: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer…
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...
CVE-2021-21978
CVE-2021-21978 CVE-2021-21978 RCE exp Affected versions VMware View Planner Harness 4.X Similar to CVE-2021-21978, this vulnerability allows uploading arbitrary files without authentication, and achieving remote code execution by modifying the built-in py script. It is worth noting that commands...
CVE-2021-21978
CVE-2021-21978 CVE-2021-21978 EXP VMware View Planner RCE CVE-2021-21978 Reverse shell...
CVE-2021-21978
CVE-2021-21978 Exploit script with echo back, a simpler way 0. Vulnerability Information The VMware View Planner Web management interface has an entry for uploading log functionality files, which requires no authentication and the log file path written is user-controllable. By overwriting the...
CVE-2019-13027
CVE-2019-13027 Details for disclosing CVE-2019-13027 Vendor contact timeline: 1st July 2019 - No response, no email back. 4th July 2019 - No response, no email back. 8th July 2019 - Email sent, Github created. 11 July 2019 - No Vendor response. Vuln disclosed. Vulnerability Type SQL Injection...
CVE-2026-1850
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash...
CVE-2026-18699
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...
CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...
CVE-2026-55876
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...
CVE-2026-55876
The Helium student planner (prior to version 2.2.60 ) is vulnerable to Stored XSS via the POST /planner/attachments/ endpoint. The root cause is that conf/configs/common.py fails to include SVG and HTML formats in the BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES lists, which th...
CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...
EUVD-2026-102221
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...
com.datasqrl:sqrl-discovery (>=0.10.6, <=0.11.5), com.datasqrl:sqrl-planner (>=0.10.6, <=0.11.5) +32 more potentially affected by CVE-2026-102463 via io.vertx:vertx-pg-client (>=5.1.0, <=5.1.9)
io.vertx:vertx-pg-client MAVEN version =5.1.0, =0.10.6, =0.10.6, =0.10.6, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =18.0.0-rc1, =1.11.0, =1.11.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-102463 Source advisory: MEND:CVE-2026-102463...
CVE-2026-55876: Improper Neutralization of Input During Web Page Generation
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKEDATTACHMENTEXTENSIONS and...
PT-2026-115088
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED ATTACHMENT EXTENSIONS and BLOCKE...