CVE-2026-63741

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...

CVE-2026-48152

Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which...

Rack CORS Data Compromise

The vulnerability of an organization’s application compatibility with Rack applications and CORS Rack-cors is related to the improper use of standard permissions. Exploiting this vulnerability can allow attackers to influence the integrity, confidentiality, and accessibility of information...

Google Chrome Developer Tools Data Compromise

The vulnerability of Google Chrome browser developer tools is related to errors in the use of standard permissions. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information from a remote location...