38,661 results · Feed
-
Medium 4.3
SurrealDB before 3.1.0 Information Disclosure via Error Messages
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend oper…
-
Medium 4.3
SurrealDB before 3.1.0 Authentication Bypass via LIVE Query
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
-
Medium 5.3
SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger t…
-
Medium 5.4
SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs …
-
Medium 6.5
SurrealDB before 3.1.0 Denial of Service via LIVE Query
SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only sel…
-
Medium 5.4
SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like…
-
Medium 6.5
SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select …
-
Unscored —
Malicious code in okite (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of okite were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload (via the Bun runtime) on import that harves…
-
Medium 6.5
SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIO…
-
Medium 6.5
SurrealDB before 3.1.0 Denial of Service nested type annotations
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
-
High 7.5
SurrealDB before 3.1.0 Denial of Service via malformed RPC use
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.
-
High 7.5
SurrealDB before 3.1.0 Denial of Service via JSON Parser
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to…
-
High 8.1
SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoi…
-
High 8.8
SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers …
-
High 7.5
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OID…
-
Medium 6.5
sigstore-js: Insufficient Verification of Data Authenticity
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion pro…
-
High 7.1
CrateDB's Blob HTTP handler bypasses authorization
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways…
-
High 7.5
Kimai before 2.58.0 Authentication Bypass via Password Reset Link
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password rese…
-
Unscored —
Malicious code in nucbox (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of nucbox were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload (via the Bun runtime) on import that harve…
-
Unscored —
Malicious code in napari-ufish (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of napari-ufish were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload (via the Bun runtime) on import that…
-
Medium 6.8
Repomix: attach_packed_output can bypass file-read secret scanning for supported local files
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file…
-
None 0.0
Concourse login flow has an open redirect issue
Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to …
-
High 7.5
Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload…
-
High 7.4
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-…
-
Medium 6.0
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandbox…
-
Medium 4.3
Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can tri…
-
Low 3.7
Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DN…
-
High 7.1
Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Corte…
-
Low —
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.
-
High 7.5
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized com…
-
High 7.5
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with e…
-
Medium 5.5
Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.i…
-
High 8.6
wetty vulnerable to DOM XSS via file-download filename
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the vi…
-
Medium 5.3
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
EasyAdminBundle ships two public Twig components — `<twig:ea:Flag countryCode="...">` and `<twig:ea:Icon name="...">` — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the T…
-
High 7.4
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV…
-
Medium 4.3
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an …
-
High 7.5
GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query fi…
-
High 7.1
GeoNetwork: Reflected XSS through client-side template injection
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS a…
-
Critical 9.8
Open Babel has out-of-bounds write in MSI translationVectors[]
Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attack…
-
Critical 9.8
Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom)
Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attack…