Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rw6-p7m8-63jp. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users...

GHSA-J6MJ-V752-PP4X Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rw6-p7m8-63jp. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users...

CVE-2026-63740

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

CVE-2026-63740 SurrealDB before 3.1.4 Array Element Permission Bypass

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

EUVD-2026-45911

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

CVE-2026-63740

SurrealDB before 3.1.4 improperly enforces SELECT permissions on array elements (field.*) for record-scoped users, causing denial of access to be bypassed and denied elements to be read. The root cause is incorrect index handling during permission filtering, enabling leakage of element-level-rest...

CVE-2026-63740

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

CVE-2026-63740 SurrealDB before 3.1.4 Array Element Permission Bypass

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

netty-codec-redis: Netty: Denial of Service via malicious Redis array header

A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity,...

Linux Distros Unpatched Vulnerability : CVE-2026-64015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the...

CVE-2026-59238: Improper Neutralization of Input During Web Page Generation

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

CVE-2026-26197: Out-of-bounds Read

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

PT-2026-61655

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in properties parse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with user properties as a JSON array instead of a JSON object. The crash occurs because strlen is...

CVE-2026-63740: Incorrect Authorization

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

PT-2026-61556

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.4 Description Incorrect index handling during permission filtering allows attackers with record scope access to read array elements that should be restricted. This occurs when the system fails to properly enforc...

Important: jackson-databind

Issue Overview: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator PTV is the primary safety mechanism guarding polymorphic deserialization. Wh...

AZL-92727 CVE-2026-64133 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache findcontrol to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it...

CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

AZL-92721 CVE-2026-64036 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

EUVD-2026-45620

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...