Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-64824

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Home-assistant
Products
Home-assistant
CVE-2026-64627

Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Parse Community Parseplatform
Products
Parse Server Parse-server
CVE-2026-64619

FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lanol Vastsa
Products
Filecodebox Filecodebox
CVE-2026-63771

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Adminer Vrana
Products
Adminer Adminer
CVE-2026-63766

GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
Rvc-boss
Products
Gpt-sovits-webui
CVE-2026-63763

SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63762

SurrealDB before v2.6.1 Denial of Service via scripting

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63761

SurrealDB before 3.1.0 Algorithm Downgrade via ES512

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 variant and the mapping defaults to ES384 without any error, warning, or log message. Users who supply the correct P-521 key for ES512 experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384), and tokens are rejected by external systems expecting genuine ES512 signatures. The flaw cannot be used to forge tokens or compromise data confidentiality or integrity, as ES384 remains cryptographically strong.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63760

SurrealDB before 3.1.0 Denial of Service via JSON Parser

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63759

SurrealDB before 3.1.0 Denial of Service nested type annotations

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63758

SurrealDB before 3.1.0 Authorization Bypass via KILL Statement

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63757

SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63756

SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63755

SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63754

SurrealDB before 3.1.0 Denial of Service via LIVE Query

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63753

SurrealDB before 3.1.0 Authentication Bypass via LIVE Query

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63752

SurrealDB before 3.1.0 RELATE Statement Record Overwrite

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63751

SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63750

SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63749

SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb