fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator URL containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization...

CVE-2026-21824

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-45974

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Abbott Laboratories, one of the world's largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patie...

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

CVE-2026-63741

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-63746 SurrealDB before 3.1.0 Permission Bypass via Graph Traversal

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

EUVD-2026-45912

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

CVE-2026-63741 SurrealDB before 3.1.0 Authentication Bypass via USE statement

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

EUVD-2026-45904

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...

CVE-2026-63733

SurrealDB prior to 3.2.0 is affected by a permissions bypass where data-modifying statements inside a PERMISSIONS clause execute with enforcement disabled. When an attacker has permission to perform a guarded operation, they can embed CREATE, UPDATE, DELETE, or UPSERT statements within the PERMIS...

dotnet: .NET: Security feature bypass due to incorrect authorization

A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...

dotnet: .NET Security Feature Bypass Vulnerability

A flaw was found in .NET. An unauthorized attacker can exploit this vulnerability over a network due to improper verification of cryptographic signatures. This allows the attacker to bypass a critical security feature, potentially leading to significant compromise of confidentiality, integrity, a...

httpd: mod_auth_digest: timing attack allows a bypass of digest authentication

A flaw was found in the modauthdigest module of httpd. A remote unauthenticated attacker can bypass digest authentication by measuring timing discrepancies of requests. This issue leads to unauthorized access to resources protected by digest authentication...

dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...

dotnet: .NET: Security feature bypass due to incorrect authorization

A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...

dotnet: .NET: Local tampering via improper link resolution

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

EUVD-2026-45891

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...