CVE-2026-28201

Open Notebook v1.8.1 is affected by CVE-2026-28201 due to improper input validation and a permissive default CORS policy. A remote attacker can trick a legitimate user into altering or deleting arbitrary database entries via a specially crafted URL, with data exfiltration possible depending on de...

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

In SurrealDB instances with the scripting capability enabled --allow-scripting, users with the ability to run arbitrary queries can trigger a server crash due to a memory-safety bug in the underlying JS engine. The SurrealDB instance terminates instantly, requiring a manual restart. The query...

GHSA-XX7M-69FF-9CRP SurrealDB vulnerable to Denial of Service through scripting function memory edge case

In SurrealDB instances with the scripting capability enabled --allow-scripting, users with the ability to run arbitrary queries can trigger a server crash due to a memory-safety bug in the underlying JS engine. The SurrealDB instance terminates instantly, requiring a manual restart. The query...

EUVD-2026-4131

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions...

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Unprivileged users for example, those with the database editor role can create or modify fields in records that contain functions or futures. Futures are values which are only computed when the value is queried. The query executes in the context of the querying user, rather than the user who...

EUVD-2025-29370

Malicious code in bioql PyPI...

EUVD-2025-29396

Malicious code in bioql PyPI...

EUVD-2025-29407

Malicious code in bioql PyPI...

EUVD-2025-29380

Malicious code in bioql PyPI...

EUVD-2025-29369

Malicious code in bioql PyPI...

EUVD-2025-29364

Malicious code in bioql PyPI...

EUVD-2025-29411

Malicious code in bioql PyPI...

EUVD-2025-31364

Malicious code in bioql PyPI...

EUVD-2025-29414

Malicious code in bioql PyPI...

Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7vm2-j586-vcvc. This link is maintained to preserve external references. Original Description A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or...

GHSA-98F8-J56X-2HH4 Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7vm2-j586-vcvc. This link is maintained to preserve external references. Original Description A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or...

CVE-2025-11060 Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records...

CVE-2025-11060

Affects SurrealDB. The flaw is in the database engine’s LIVE QUERY subscription mechanism (LIVE SELECT) that can cause record/guest users to observe unauthorized records within the same table by abusing how change notifications respect (or don’t respect) the user’s security context when other use...

surrealdb 安全漏洞

surrealdb is an open source document graph database from SurrealDB. A security vulnerability exists in surrealdb that stems from a flaw in the database engine's real-time query subscription mechanism, which could lead to a record or guest user bypassing access control via a specially crafted LIVE...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the LIVE SELECT process. An attacker can access unauthorized records by subscribing to live queries on a table and observing data changes triggered by other users, thereby bypassing intended access controls...