Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 107 total.
Information exposure via unauthenticated share access in filebrowser (CVE-2026-46410)
An unauthenticated user can access shared content in a way that exposes sensitive information, including source and path details. This vulnerability allows unauthorized parties to obtain data that should be protected,...
Fixed in 1.3.2-stable; 1.4.1-beta
Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)
An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign them...
Fixed in 4.0.7; 4.1.2
SQL injection in Apache Syncope Audit Events search (CVE-2026-57308)
Apache Syncope contains an SQL injection vulnerability in its Audit Events search functionality. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort...
Fixed in 4.0.7; 4.1.2
Path traversal in FileBrowser Quantum subtitle handler endpoint (CVE-2026-54910)
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) in FileBrowser Quantum accepts two user-controlled query parameters, `path` and `name`, both of which are used in filesystem operations without sanitization...
Fixed in 1.4.3-beta
Signature verification bypass in Network-AI APSAdapter (CVE-2026-64623)
APSAdapter in the network-ai npm package initialises with a `local` verification mode by default. When no custom `verifySignature` callback is supplied, the built-in fallback verifier accepts any non-empty string as a...
Fixed in 5.13.4
Confused deputy privilege escalation in SurrealDB via future fields and functions (CVE-2026-63763)
Unprivileged users with roles such as database editor can create or modify record fields containing futures, functions, or closures. Because these constructs execute in the context of the querying or invoking user rat...
Fixed in 2.5.0; 3.0.0-beta.3
Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a deeply...
Fixed in 3.1.0
Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
SurrealDB's type/kind parser failed to enforce the configured recursion depth limit when processing nested type annotations, unlike the expression parser which already applied this limit. An authenticated attacker can...
Fixed in 3.1.0
Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
The HTTP `/rpc` `sessions` method in SurrealDB returned all attached session UUIDs without requiring authentication, and the `/rpc` handler accepted arbitrary session identifiers with no ownership verification. An una...
Fixed in 3.1.0
Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
SurrealDB evaluates user-supplied WHERE clauses and SET/MERGE/CONTENT/PATCH clauses against full record data before enforcing table-level PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user, including Rec...
Fixed in 3.1.0
Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
A LIVE query whose WHERE clause evaluates to an error causes the error to propagate to the triggering write transaction, rolling back the attempted change. An authenticated user with only select permission on a table ...
Fixed in 3.1.0
Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
SurrealDB's RPC `use` handler panics when a database is specified without a namespace, because the handler calls `.expect("namespace should be set")` and the core library is built with `panic = 'abort'`, causing the p...
Fixed in 3.1.0
Table SELECT permission bypass via graph traversal in SurrealDB (CVE-2026-63746)
Authenticated record or scope users in SurrealDB can read records from any table reachable through graph edges or REFERENCES TO back-references, bypassing that table's PERMISSIONS FOR select clause entirely. The flaw ...
Fixed in 3.1.0
Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
SurrealDB fails to correctly enforce element-level (`field.*`) SELECT permissions for record users. Instead of hiding denied array elements, the engine leaks a subset of them due to incorrect index handling during per...
Fixed in 3.1.4
Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
SurrealDB's DEFINE ANALYZER mapper() filter allows database users with the EDITOR or OWNER role to specify arbitrary file paths and retrieve file contents through query error messages. File access is intended to be re...
Fixed in 3.1.5
Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)
Authenticated users can crash a SurrealDB server by submitting a single query containing a long chain of operators (e.g., tens of thousands of chained addition terms). The query is parsed into an unbounded expression ...
Fixed in 3.1.5
Tenant scope bypass in SurrealDB custom API routes (CVE-2026-63735)
Authenticated users in any namespace/database can invoke custom API endpoints belonging to other namespaces/databases by specifying the target scope in the URL path or via namespace/database headers. The route applied...
Fixed in 3.2.0
Heap-based buffer overflow in Wazuh agent syscheck registry wildcard expansion (CVE-2026-40106)
A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards, the agent allocates a fixed 256-byte heap buffer and performs unsafe st...
Fixed in >=4.14.5
Rate limit bypass via /events endpoint in Wazuh Manager (CVE-2026-33434)
A logic error in `CheckRateLimitsMiddleware.dispatch()` unconditionally overwrites the global rate limit check result with the /events endpoint-specific check result, discarding whether the global `max_request_per_min...
Fixed in >= 4.14.5
Stored XSS via link annotations in ArgoCD enabling privilege escalation (CVE-2026-45738)
A user with developer-role application write access can set `link.argocd.argoproj.io/*` annotations containing `javascript:` URIs using a pipe-separator trick, which are rendered as `<a href>` elements in the applicat...
Fixed in 3.2.12; 3.3.10; 3.4.2