Security advisories

critical2026-07-01

CVE-2026-44935-Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

rancher/fleet · GHSA-xr65-5cpm-g36x

medium2026-07-01

CVE-2026-44936-Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

rancher/fleet · GHSA-hx4v-cxpf-vh8m

critical2026-07-01

CVE-2026-44939-Rancher vulnerable to command injection through unsanitized YAML parameter

rancher/rancher · GHSA-mhc6-2gfq-xx62

high2026-07-01

CVE-2026-44937-Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

rancher/fleet · GHSA-jmf4-m7j9-g72r

high2026-07-01

CVE-2026-44938-Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

rancher/fleet · GHSA-864g-863m-vcvq

critical2026-07-01

CVE-2026-49457-QUIC has Broken TLS verification

benoitc/erlang_quic · GHSA-2r8v-p65x-3663

low2026-07-01

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

oras-project/oras-java · GHSA-j6hm-v3x2-qv6j

high2026-07-01

CVE-2026-49998-Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

centrifugal/centrifugo · GHSA-g6vg-wj8f-48cj

medium2026-07-01

CVE-2026-49997-SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

surrealdb/surrealdb · GHSA-whwg-vh4f-pmmf

medium2026-07-01

CVE-2026-63761-SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

surrealdb/surrealdb · GHSA-fwg2-gr34-q3w8

medium2026-07-01

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

surrealdb/surrealdb · GHSA-c8jx-96c9-8xrp

medium2026-07-01

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

surrealdb/surrealdb · GHSA-wp87-mgvq-5j93

medium2026-07-01

CVE-2026-63743-SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

surrealdb/surrealdb · GHSA-97vg-427p-8hx5

medium2026-07-01

SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions

surrealdb/surrealdb · GHSA-6wqw-vhfr-9999

medium2026-07-01

SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission

surrealdb/surrealdb · GHSA-f82j-v89j-mf86

medium2026-07-01

CVE-2026-63751-SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

surrealdb/surrealdb · GHSA-fpxg-5xmv-922m

medium2026-07-01

CVE-2026-63748-SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

surrealdb/surrealdb · GHSA-6g9v-7gq3-p2c6

medium2026-07-01

SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

surrealdb/surrealdb · GHSA-4m82-p8cx-f94j

medium2026-07-01

SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames

surrealdb/surrealdb · GHSA-65rj-r9fh-jp2v

medium2026-07-01

CVE-2026-63758-SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

surrealdb/surrealdb · GHSA-gcwr-5mrf-fvch