CVE-2023-31584

CVE-2023-31584 - cu/silicon におけるクロスサイトスクリプティングの脆弱性 Github リンク: https://github.com/cu/silicon 影響を受けるバージョン: 1 深刻度と CVSS: NIST によるレビュー完了後に更新予定。 種類: クロスサイトスクリプティング 根本原因: ユーザー提供データ（タイトルと本文）をデータベースに挿入する前に、適切な入力検証とサニタイズが行われていない。 影響: 情報漏洩 以下は影響を受ける関数です。...

CVE-2026-63745

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745

SurrealDB prior to 3.1.0 contains an authorization bypass in which authenticated users can spoof composite record-id field values by writing to editable body fields. This allows bypassing permission checks that gate access on id components (e.g., tenant isolation) by setting same-named body field...

CVE-2026-63745

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...