Rezultati pretraživanja za 'Od datuma: 03.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-109339 | 4.9 | SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module | 2026-10-12 17:17:30 | 2026-10-12 17:17:30 |
| CVE-2026-109338 | 6.5 | SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), | 2026-10-12 17:17:30 | 2026-10-12 17:17:30 |
| CVE-2026-109337 | 4.3 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated pred | 2026-10-12 17:17:30 | 2026-10-12 17:17:29 |
| CVE-2026-109336 | 4.3 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109335 | 6.5 | SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields d | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109334 | 8.1 | SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surrea | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109333 | 6.5 | SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespac | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109332 | 3.1 | Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server bi | 2026-10-12 17:17:29 | 2026-10-12 17:17:29 |
| CVE-2026-109331 | 7.4 | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous pay | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| CVE-2026-109330 | 4.3 | Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a vict | 2026-10-12 17:17:28 | 2026-10-12 17:17:28 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/13175
Zapisa po stranici: