SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

A record user could learn the value of a hidden field by counting how many records match a guess. When `DEFINE FIELD ..

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NA

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB offers `http::*` functions that can access external network endpoints, with the `--allow-net` and `--deny-net`

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions

A record user could read records the table's SELECT permission expression should have hidden, when that expression refer

历史摘要 · 未重新核验 · GitHub Advisory

Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study.

本文以Rust语言为案例，系统研究了采用安全编程语言对软件安全性和开发实践的影响。研究背景在于内存安全漏洞（如缓冲区溢出、释放后使用）是现有C/C++程序的主要安全威胁，而Rust通过所有权、借用检查等机制在编译期消除这些漏洞。然而，迁移到

历史摘要 · 未重新核验 · USENIX Security

Cargo crates in third party registries can override the cached source of other crates

CVE-2026-5223

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded

历史摘要 · 未重新核验 · GitHub Advisory

Cargo can be coerced to share credentials between registries

CVE-2026-5222

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using

历史摘要 · 未重新核验 · GitHub Advisory

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

## Impact Following the path-safety patches in [GHSA-wx3m-whqv-xv47](https://github.com/umanio-agency/skillctl/security

历史摘要 · 未重新核验 · GitHub Advisory

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

CVE-2026-33646

## Summary Mise processes `.tool-versions` files through the Tera template engine during parsing, with the `exec()` fun

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Denial of Service via deep operator chains

An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a q

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

SurrealDB fetches the JWKS document for a JWT or record access method using a bare `reqwest` client that follows HTTP re

历史摘要 · 未重新核验 · GitHub Advisory

Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions

CVE-2026-11941

### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functio

历史摘要 · 未重新核验 · GitHub Advisory

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

CVE-2026-55517

## Summary A Deno program that opens a client `WebSocket` connection could be crashed by the remote server. While handl

历史摘要 · 未重新核验 · GitHub Advisory

PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

`PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21–0.22 series) required the suppl

历史摘要 · 未重新核验 · GitHub Advisory

PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators

PyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIte

历史摘要 · 未重新核验 · GitHub Advisory

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

CVE-2026-48110

# SSH message fields were decoded through allocation-first parsers before field-specific bounds ### Summary Several `r

历史摘要 · 未重新核验 · GitHub Advisory

Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

CVE-2026-48108

### Summary `russh` did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the

历史摘要 · 未重新核验 · GitHub Advisory