https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 15 Sep 2026 20:44:07 +0000 https://vulnerability.circl.lu/sighting/dafe926e-1e15-4f65-9722-628d6a114f68/export {"uuid": "dafe926e-1e15-4f65-9722-628d6a114f68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63735", "type": "seen", "source": "https://gist.github.com/alon710/c72bc251650f3404e8bd8c874dab4c7c", "content": "# CVE-2026-63735: CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63735\n\n## Summary\nSurrealDB prior to version 3.2.0 is vulnerable to an authorization bypass where authenticated users can invoke custom API endpoints belonging to other tenants. This cross-tenant data access occurs because the system fails to validate authorization scope boundaries against request-supplied namespace and database identifiers before executing scripts with elevated definer's rights.\n\n## TL;DR\nAn authenticated SurrealDB user with minimal privileges can access and execute custom APIs defined by other tenants in multi-tenant environments, leading to unauthorized read/write access to arbitrary database resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639: Authorization Bypass Through User-Controlled Key\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00367 (Percentile: 29.78%)\n- **Exploit Status**: PoC (Proof of Concept documented in integration tests)\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Improper Authorization\n\n## Affected Systems\n\n- SurrealDB instances deployed in multi-tenant environments\n- SurrealDB versions prior to 3.2.0\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade the database engine to version 3.2.0 or later to ensure proper tenant boundary validation.\n- Manually implement identity verification using $auth context variables within custom API endpoints.\n- Use reverse proxies or API gateways to strip or block unauthorized URL paths targeting sensitive namespaces.\n\n**Remediation Steps:**\n1. Identify all deployed SurrealDB instances and run `surreal version` to check if they are below 3.2.0.\n2. Download and install the 3.2.0 or later package from official distribution repositories.\n3. Restart the SurrealDB services with the updated binaries.\n4. Verify the patch by attempting a cross-tenant API invocation using a test account to confirm the server returns a 403 Permission Denied error.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw)\n- [CNA Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api)\n- [CVE Record Database Entry](https://www.cve.org/CVERecord?id=CVE-2026-63735)\n- [Wiz Vulnerability Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-63735)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T12:32:19.070597Z"} {"uuid": "dafe926e-1e15-4f65-9722-628d6a114f68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63735", "type": "seen", "source": "https://gist.github.com/alon710/c72bc251650f3404e8bd8c874dab4c7c", "content": "# CVE-2026-63735: CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63735\n\n## Summary\nSurrealDB prior to version 3.2.0 is vulnerable to an authorization bypass where authenticated users can invoke custom API endpoints belonging to other tenants. This cross-tenant data access occurs because the system fails to validate authorization scope boundaries against request-supplied namespace and database identifiers before executing scripts with elevated definer's rights.\n\n## TL;DR\nAn authenticated SurrealDB user with minimal privileges can access and execute custom APIs defined by other tenants in multi-tenant environments, leading to unauthorized read/write access to arbitrary database resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639: Authorization Bypass Through User-Controlled Key\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00367 (Percentile: 29.78%)\n- **Exploit Status**: PoC (Proof of Concept documented in integration tests)\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Improper Authorization\n\n## Affected Systems\n\n- SurrealDB instances deployed in multi-tenant environments\n- SurrealDB versions prior to 3.2.0\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade the database engine to version 3.2.0 or later to ensure proper tenant boundary validation.\n- Manually implement identity verification using $auth context variables within custom API endpoints.\n- Use reverse proxies or API gateways to strip or block unauthorized URL paths targeting sensitive namespaces.\n\n**Remediation Steps:**\n1. Identify all deployed SurrealDB instances and run `surreal version` to check if they are below 3.2.0.\n2. Download and install the 3.2.0 or later package from official distribution repositories.\n3. Restart the SurrealDB services with the updated binaries.\n4. Verify the patch by attempting a cross-tenant API invocation using a test account to confirm the server returns a 403 Permission Denied error.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw)\n- [CNA Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api)\n- [CVE Record Database Entry](https://www.cve.org/CVERecord?id=CVE-2026-63735)\n- [Wiz Vulnerability Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-63735)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T12:32:19.070597Z"} https://vulnerability.circl.lu/sighting/dafe926e-1e15-4f65-9722-628d6a114f68/export Sat, 05 Sep 2026 12:32:19 +0000 https://vulnerability.circl.lu/sighting/a506c4de-004f-4d07-aef8-e8d3e5f7f64b/export {"uuid": "a506c4de-004f-4d07-aef8-e8d3e5f7f64b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63733", "type": "seen", "source": "https://gist.github.com/alon710/e67772431cb25b3e742f3376d1f6891a", "content": "# CVE-2026-63733: CVE-2026-63733: Incorrect Authorization in SurrealDB Permissions Clause\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63733\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) in SurrealDB allows authenticated, low-privileged users to execute unauthorized state-modifying queries. This occurs because the database disabled permissions during evaluation of custom PERMISSIONS WHERE predicates to prevent infinite recursion.\n\n## TL;DR\nA design flaw in SurrealDB allows authenticated users to bypass read-only database permission rules, enabling unauthorized writes and data modification through nested permission queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3\n- **EPSS Score**: 0.00287\n- **Impact**: Incorrect Authorization (Integrity Bypass)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SurrealDB\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade database instances to SurrealDB 3.2.0 or newer.\n- Review existing user-defined functions and database schemas for state-modifying actions inside PERMISSIONS WHERE clauses.\n- Limit user access to critical schema configuration controls and restrict access roles to the absolute minimum necessary.\n\n**Remediation Steps:**\n1. Connect to the target SurrealDB database using administrative credentials.\n2. Execute `INFO FOR DB;` to export and extract all active schema configurations.\n3. Examine all `DEFINE TABLE`, `DEFINE FIELD`, and `DEFINE FUNCTION` directives for `PERMISSIONS ... WHERE` statements.\n4. Rewrite custom filters to use static, variable-based criteria (e.g. `$auth.id` comparison) instead of querying or calling stateful functions.\n5. Deploy SurrealDB version 3.2.0 via your standard container or package management pipeline.\n\n## References\n\n- [SurrealDB GitHub Security Advisory (GHSA-66r2-5gwj-gxm2)](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause)\n- [SurrealDB v3.2.0 Release Notes](https://github.com/surrealdb/surrealdb/releases/tag/v3.2.0)\n- [CVE-2026-63733 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T11:31:54.125388Z"} {"uuid": "a506c4de-004f-4d07-aef8-e8d3e5f7f64b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63733", "type": "seen", "source": "https://gist.github.com/alon710/e67772431cb25b3e742f3376d1f6891a", "content": "# CVE-2026-63733: CVE-2026-63733: Incorrect Authorization in SurrealDB Permissions Clause\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63733\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) in SurrealDB allows authenticated, low-privileged users to execute unauthorized state-modifying queries. This occurs because the database disabled permissions during evaluation of custom PERMISSIONS WHERE predicates to prevent infinite recursion.\n\n## TL;DR\nA design flaw in SurrealDB allows authenticated users to bypass read-only database permission rules, enabling unauthorized writes and data modification through nested permission queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3\n- **EPSS Score**: 0.00287\n- **Impact**: Incorrect Authorization (Integrity Bypass)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SurrealDB\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade database instances to SurrealDB 3.2.0 or newer.\n- Review existing user-defined functions and database schemas for state-modifying actions inside PERMISSIONS WHERE clauses.\n- Limit user access to critical schema configuration controls and restrict access roles to the absolute minimum necessary.\n\n**Remediation Steps:**\n1. Connect to the target SurrealDB database using administrative credentials.\n2. Execute `INFO FOR DB;` to export and extract all active schema configurations.\n3. Examine all `DEFINE TABLE`, `DEFINE FIELD`, and `DEFINE FUNCTION` directives for `PERMISSIONS ... WHERE` statements.\n4. Rewrite custom filters to use static, variable-based criteria (e.g. `$auth.id` comparison) instead of querying or calling stateful functions.\n5. Deploy SurrealDB version 3.2.0 via your standard container or package management pipeline.\n\n## References\n\n- [SurrealDB GitHub Security Advisory (GHSA-66r2-5gwj-gxm2)](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause)\n- [SurrealDB v3.2.0 Release Notes](https://github.com/surrealdb/surrealdb/releases/tag/v3.2.0)\n- [CVE-2026-63733 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T11:31:54.125388Z"} https://vulnerability.circl.lu/sighting/a506c4de-004f-4d07-aef8-e8d3e5f7f64b/export Sat, 05 Sep 2026 11:31:54 +0000 https://vulnerability.circl.lu/sighting/526edb73-65b7-4918-9b65-6e6b05a5a3a4/export {"uuid": "526edb73-65b7-4918-9b65-6e6b05a5a3a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63732", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwwpvlti2c", "content": "\ud83d\udd34 CVE-2026-63732 - Critical (9.9)\n\n9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default passwor...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63732/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-23T23:00:37.952148Z"} {"uuid": "526edb73-65b7-4918-9b65-6e6b05a5a3a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63732", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwwpvlti2c", "content": "\ud83d\udd34 CVE-2026-63732 - Critical (9.9)\n\n9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default passwor...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63732/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-23T23:00:37.952148Z"} https://vulnerability.circl.lu/sighting/526edb73-65b7-4918-9b65-6e6b05a5a3a4/export Thu, 23 Jul 2026 23:00:37 +0000 https://vulnerability.circl.lu/sighting/160efd03-c7e4-49f7-86fc-22e85a767dd1/export {"uuid": "160efd03-c7e4-49f7-86fc-22e85a767dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63732", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrdurt2jik2k", "content": "CVE-2026-63732 - 9router\nThe 9router software has a default password that can be used by attackers to access the system. This allows them to run malicious code on the host operating system. Update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#9router #decolua #CVE #infosec", "creation_timestamp": "2026-07-23T22:22:06.103191Z"} {"uuid": "160efd03-c7e4-49f7-86fc-22e85a767dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63732", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrdurt2jik2k", "content": "CVE-2026-63732 - 9router\nThe 9router software has a default password that can be used by attackers to access the system. This allows them to run malicious code on the host operating system. Update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#9router #decolua #CVE #infosec", "creation_timestamp": "2026-07-23T22:22:06.103191Z"} https://vulnerability.circl.lu/sighting/160efd03-c7e4-49f7-86fc-22e85a767dd1/export Thu, 23 Jul 2026 22:22:06 +0000 https://vulnerability.circl.lu/sighting/e7730340-f1f2-44f7-8a33-024bd19c43de/export {"uuid": "e7730340-f1f2-44f7-8a33-024bd19c43de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63739", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrcgomyp6o2s", "content": "\ud83d\udccc CVE-2026-63739 - SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OW... https://www.cyberhub.blog/cves/CVE-2026-63739", "creation_timestamp": "2026-07-23T08:37:06.715154Z"} {"uuid": "e7730340-f1f2-44f7-8a33-024bd19c43de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63739", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrcgomyp6o2s", "content": "\ud83d\udccc CVE-2026-63739 - SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OW... https://www.cyberhub.blog/cves/CVE-2026-63739", "creation_timestamp": "2026-07-23T08:37:06.715154Z"} https://vulnerability.circl.lu/sighting/e7730340-f1f2-44f7-8a33-024bd19c43de/export Thu, 23 Jul 2026 08:37:06 +0000 https://vulnerability.circl.lu/sighting/44aba214-6864-48b8-aee5-629d2c1e8bb8/export {"uuid": "44aba214-6864-48b8-aee5-629d2c1e8bb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63735", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrceyz5wch2s", "content": "\ud83d\udccc CVE-2026-63735 - SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints i... https://www.cyberhub.blog/cves/CVE-2026-63735", "creation_timestamp": "2026-07-23T08:07:08.245498Z"} {"uuid": "44aba214-6864-48b8-aee5-629d2c1e8bb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63735", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrceyz5wch2s", "content": "\ud83d\udccc CVE-2026-63735 - SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints i... https://www.cyberhub.blog/cves/CVE-2026-63735", "creation_timestamp": "2026-07-23T08:07:08.245498Z"} https://vulnerability.circl.lu/sighting/44aba214-6864-48b8-aee5-629d2c1e8bb8/export Thu, 23 Jul 2026 08:07:08 +0000 https://vulnerability.circl.lu/sighting/55ef4062-9578-496b-80ab-580e41f6890c/export {"uuid": "55ef4062-9578-496b-80ab-580e41f6890c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/116956203969941945", "content": "CVE-2026-63731 - SSRF in HyperDX before 2.31.0. Authenticated users can probe internal services and access cloud metadata. CVSS 7.7. No patch available yet. Monitor for updates and restrict network access. #CVE #infosec #HyperDX\nhttps://www.valtersit.com/cve/CVE-2026-63731/", "creation_timestamp": "2026-07-21T05:00:47.698803Z"} {"uuid": "55ef4062-9578-496b-80ab-580e41f6890c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/116956203969941945", "content": "CVE-2026-63731 - SSRF in HyperDX before 2.31.0. Authenticated users can probe internal services and access cloud metadata. CVSS 7.7. No patch available yet. Monitor for updates and restrict network access. #CVE #infosec #HyperDX\nhttps://www.valtersit.com/cve/CVE-2026-63731/", "creation_timestamp": "2026-07-21T05:00:47.698803Z"} https://vulnerability.circl.lu/sighting/55ef4062-9578-496b-80ab-580e41f6890c/export Tue, 21 Jul 2026 05:00:47 +0000 https://vulnerability.circl.lu/sighting/cfefc08d-f587-42f3-931b-5adce63df6e9/export {"uuid": "cfefc08d-f587-42f3-931b-5adce63df6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr4znx6h572j", "content": "CVE-2026-63731 - SSRF in HyperDX before 2.31.0. Authenticated users can probe internal services and access cloud metadata. CVSS 7.7. No patch available yet. Monitor for updates and restrict network access. #CVE #infosec #HyperDX\n\nhttps://www.valtersit.com/cve/CVE-2026-63731/", "creation_timestamp": "2026-07-21T05:00:46.389162Z"} {"uuid": "cfefc08d-f587-42f3-931b-5adce63df6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr4znx6h572j", "content": "CVE-2026-63731 - SSRF in HyperDX before 2.31.0. Authenticated users can probe internal services and access cloud metadata. CVSS 7.7. No patch available yet. Monitor for updates and restrict network access. #CVE #infosec #HyperDX\n\nhttps://www.valtersit.com/cve/CVE-2026-63731/", "creation_timestamp": "2026-07-21T05:00:46.389162Z"} https://vulnerability.circl.lu/sighting/cfefc08d-f587-42f3-931b-5adce63df6e9/export Tue, 21 Jul 2026 05:00:46 +0000 https://vulnerability.circl.lu/sighting/bc3900ee-b54a-4edd-a917-41c92e523d29/export {"uuid": "bc3900ee-b54a-4edd-a917-41c92e523d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr43iedw2s23", "content": "\ud83d\udfe0 CVE-2026-63731 - High (7.7)\n\nHyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authentica...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63731/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T20:00:46.645672Z"} {"uuid": "bc3900ee-b54a-4edd-a917-41c92e523d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63731", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr43iedw2s23", "content": "\ud83d\udfe0 CVE-2026-63731 - High (7.7)\n\nHyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authentica...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63731/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T20:00:46.645672Z"} https://vulnerability.circl.lu/sighting/bc3900ee-b54a-4edd-a917-41c92e523d29/export Mon, 20 Jul 2026 20:00:46 +0000 https://vulnerability.circl.lu/sighting/a133e9a0-d074-4bb0-a4c4-1a18febc6564/export {"uuid": "a133e9a0-d074-4bb0-a4c4-1a18febc6564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63739", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3fpfnebr2e", "content": "CVE-2026-63739 - SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER\nCVE ID : CVE-2026-63739\n \n Published : July 20, 2026, 12:19 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER...", "creation_timestamp": "2026-07-20T13:31:00.238504Z"} {"uuid": "a133e9a0-d074-4bb0-a4c4-1a18febc6564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63739", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3fpfnebr2e", "content": "CVE-2026-63739 - SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER\nCVE ID : CVE-2026-63739\n \n Published : July 20, 2026, 12:19 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER...", "creation_timestamp": "2026-07-20T13:31:00.238504Z"} https://vulnerability.circl.lu/sighting/a133e9a0-d074-4bb0-a4c4-1a18febc6564/export Mon, 20 Jul 2026 13:31:00 +0000