2026-07-21 归档

今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELEC...

CVE-2026-63758

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts a...

CVE-2026-63757

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns at

历史摘要 · 未重新核验 · NVD

#cve #cwe-306

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated sessio...

CVE-2026-63756

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-362

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and REL...

CVE-2026-63755

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses i

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and D...

CVE-2026-63754

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clause

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications un...

CVE-2026-63753

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. At

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attacker...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames...

CVE-2026-63750

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket c

历史摘要 · 未重新核验 · NVD

#cve #cwe-770

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or ...

CVE-2026-63749

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permis

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT p...

CVE-2026-63748

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-209

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can se...

CVE-2026-63747

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fi...

CVE-2026-63745

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof compos

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against networ...

CVE-2026-63744

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redire

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers...

CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated us

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields w...

CVE-2026-63742

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can crea...

CVE-2026-63741

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. A...

CVE-2026-63740

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files acc...

CVE-2026-63739

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows da

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attack...

CVE-2026-63737

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server

历史摘要 · 未重新核验 · NVD

#cve #cwe-674

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking ...

CVE-2026-63736

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the

历史摘要 · 未重新核验 · NVD

#cve #cwe-918