Total
4683 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-14774 | 1 Abb | 1 T-mac Plus | 2026-07-22 | N/A | 7.4 HIGH |
| Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. | |||||
| CVE-2026-63733 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 4.3 MEDIUM |
| SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption. | |||||
| CVE-2026-63738 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 4.3 MEDIUM |
| SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans. | |||||
| CVE-2026-63740 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 6.5 MEDIUM |
| SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering. | |||||
| CVE-2026-63742 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 4.3 MEDIUM |
| SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses. | |||||
| CVE-2026-63749 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 4.3 MEDIUM |
| SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden. | |||||
| CVE-2026-63751 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 4.3 MEDIUM |
| SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields. | |||||
| CVE-2026-63755 | 1 Surrealdb | 1 Surrealdb | 2026-07-22 | N/A | 6.5 MEDIUM |
| SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries. | |||||
| CVE-2025-32348 | 1 Google | 1 Android | 2026-07-22 | N/A | 7.8 HIGH |
| In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-10211 | 2026-07-22 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-22872 | 1 Projectcapsule | 1 Capsule | 2026-07-22 | N/A | 9.1 CRITICAL |
| Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Prior to version 0.13.0, tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks. The attack vector has a few limiting factors. This attack requires Tenant Owner privileges and requires Capsule Controller running with cluster-admin privileges (default configuration). Additionally, some clusters may have additional admission controllers blocking malicious resources. Version 0.13.0 patches this issue. | |||||
| CVE-2026-49369 | 1 Jetbrains | 1 Youtrack | 2026-07-22 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages | |||||
| CVE-2026-49376 | 1 Jetbrains | 1 Teamcity | 2026-07-22 | N/A | 6.5 MEDIUM |
| In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin | |||||
| CVE-2026-62209 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.1 HIGH |
| OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. | |||||
| CVE-2026-44654 | 1 Librechat | 1 Librechat | 2026-07-21 | N/A | 8.1 HIGH |
| LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through `DELETE /api/files` that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same `file_id`. The private agent retains a stale `file_id` reference that no longer resolves. A shared-agent editor can destroy files that the owner uses across multiple agents. The owner's private agents — which the attacker has no access to — break silently with stale `file_id` references. This is a cross-agent integrity violation: editing access to one agent should not affect another. Version 0.8.4 contains a patch. | |||||
| CVE-2026-10755 | 2026-07-21 | N/A | 2.7 LOW | ||
| The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state. | |||||
| CVE-2026-53515 | 1 Better-auth | 2 Better-auth\/sso, Better Auth | 2026-07-21 | N/A | 7.1 HIGH |
| Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11. | |||||
| CVE-2026-35674 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements, enabling unauthorized plugin, config, MCP, allowlist, and ACP mutations. | |||||
| CVE-2026-34507 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 5.4 MEDIUM |
| OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked. | |||||
| CVE-2026-35673 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by reusing blocked tabs to export or inspect content that should remain protected. | |||||