2026

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allo

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket c

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permis

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE ac

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references.

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof compos

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redire

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated us

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through g

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows aut

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMIS

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an o

A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The int

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` a

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encod

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning p

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing a

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it veri

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value be

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a re

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing u

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellatio

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` v

In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update fa

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_ite

In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init S

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference lea

In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix memory block reference leak

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipc_

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map->ops->elt_free() if elt_al

In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pm_runtime leak on mutex_lock failu

In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup f

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setu

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup

In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel kho_fill_kimage() u

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check for NULL FF-A ID table whi

In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic conte

In the Linux kernel, the following vulnerability has been resolved: test_kprobes: clear kprobes between test runs Runn