36137 matches found
GHSA-WHWG-VH4F-PMMF SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
In SurrealDB, records can be connected as a graph: a RELATE statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent. A user with permission to delete a node could also delete the edges...
CVE-2024-26281 vulnerabilities
Vulnerabilities for packages: firefox-esr...
GHSA-HJXQ-W2WW-JFJ3 vulnerabilities
Vulnerabilities for packages: firefox-esr...
CVE-2024-26283 vulnerabilities
Vulnerabilities for packages: firefox-esr...
CVE-2024-1554 vulnerabilities
Vulnerabilities for packages: firefox-esr...
CVE-2024-0754 vulnerabilities
Vulnerabilities for packages: firefox-esr...
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding DEFINE NAMESPACE or DEFINE DATABASE permission. USE NS and USE DB automatically create the target when it does not exist. The three places USE is handled — the RPC use method,...
GHSA-65RJ-R9FH-JP2V SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
An anonymous caller could degrade /sql availability by streaming WebSocket frames many times larger than the operator-configured per-connection limit. The /sql upgrade handler accepted anonymous connections and did not propagate SURREALWEBSOCKETMAXMESSAGESIZE to the WebSocket protocol layer —...
SurrealDB vulnerable to Denial of Service due to nested types annotations
The SurrealDB type/kind parser did not enforce the configured recursion depth limit when parsing nested type annotations. The expression parser already enforced the limit for analogous constructs; the kind parser omitted it. An authenticated attacker could send a query with deeply nested type...
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
The HTTP /rpc endpoint has a time-of-check/time-of-use TOCTOU race condition on internal session state. When authenticated and unauthenticated requests are processed concurrently, the unauthenticated request can inherit the authenticated user's session and privileges. The /rpc endpoint is the...
PYSEC-2026-605 Malicious code in nucbox (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of nucbox were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...
Critical: Red Hat Security Advisory: RHOAI 3.4.2 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.2 provides these changes:...
GHSA-F29H-2H58-48R7 Open Babel has out-of-bounds write in PQS coord_file parser
Summary A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordfile parsing path of the PQS reader. A malformed coord file specifier caused the parser to write past the end of its destination...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update
An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...
CVE-2026-58038
The CVE-2026-58038 issue affects the Wikimedia Foundation Timeline component and is caused by improper neutralization of input during web page generation, enabling cross-site scripting via Timeline.Php and scripts/EasyTimeline.Pl. Reported impacts include information disclosure, session hijacking...
GHSA-7873-QCMM-76JC vulnerabilities
Vulnerabilities for packages: firefox-esr...
CVE-2023-4053 vulnerabilities
Vulnerabilities for packages: firefox-esr...
GHSA-GVR6-G64H-9MJ2 vulnerabilities
Vulnerabilities for packages: firefox-esr...