29936 matches found
Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hv6h-hc26-q48p. This link is maintained to preserve external references. Original Description SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed throug...
SUSE-SU-2026:22879-1 Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 16)
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues The following security issues were fixed: - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down bsc1267206. - CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink...
CVE-2026-63738
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...
EUVD-2026-45909
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...
Malicious Package
Overview @gocortexio/npmgremlinbox-cc-by-sa-3-0-at is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
CVE-2026-63982
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...
CVE-2026-63738: Incorrect Authorization
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...
Linux Distros Unpatched Vulnerability : CVE-2026-64092
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown...
Linux Distros Unpatched Vulnerability : CVE-2026-64182
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblknrpoisoninc...
Linux Distros Unpatched Vulnerability : CVE-2026-63948
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work...
CVE-2026-63875
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When hugepmdunshare is called to unshare a PMD table, the tlbunsharepmdptdesc function sets tlb-unsharedtables=true but the aarch64 tlbflush only checked tlb-freedtables to...
Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-136 (ALASDOCKER-2026-136)
The version of runfinch-finch installed on the remote host is prior to 1.17.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-136 advisory. containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launch...
Linux Distros Unpatched Vulnerability : CVE-2026-64044
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls...
kernel security update
6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...
BIT-HUBBLE-RELAY-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...
BIT-CILIUM-OPERATOR-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant...
CVE-2026-45138
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...
EUVD-2026-45875
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...
CVE-2026-45138 CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...
