Rezultati pretraživanja za 'Od datuma: 03.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-109337 | 4.3 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated pred | 2026-10-12 17:17:30 | 2026-10-12 17:17:29 |
| CVE-2026-109336 | 4.3 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109335 | 6.5 | SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields d | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109334 | 8.1 | SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surrea | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109333 | 6.5 | SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespac | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109332 | 3.1 | Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server bi | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109331 | 7.4 | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous pay | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| CVE-2026-109330 | 4.3 | Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a vict | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| CVE-2026-109329 | 6.5 | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.ph | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| CVE-2026-109328 | 6.1 | Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/13149
Zapisa po stranici: