| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-109342 | SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method | surrealdb | surrealdb | Medium | 5.4 | 2026-10-12 16:05:28 | Deep Dive |
| CVE-2026-109340 | SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE | surrealdb | surrealdb | Medium | 5.4 | 2026-10-12 16:05:27 | Deep Dive |
| CVE-2026-109341 | SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations | surrealdb | surrealdb | High | 7.1 | 2026-10-12 16:05:27 | Deep Dive |
| CVE-2026-109339 | SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering | surrealdb | surrealdb | Medium | 4.9 | 2026-10-12 16:05:26 | Deep Dive |
| CVE-2026-109338 | SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values | surrealdb | surrealdb | Medium | 6.5 | 2026-10-12 16:05:25 | Deep Dive |
| CVE-2026-109337 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause | surrealdb | surrealdb | Medium | 4.3 | 2026-10-12 16:05:24 | Deep Dive |
| CVE-2026-109336 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after | surrealdb | surrealdb | Medium | 4.3 | 2026-10-12 16:05:24 | Deep Dive |
| CVE-2026-109335 | SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields | surrealdb | surrealdb | Medium | 6.5 | 2026-10-12 16:05:23 | Deep Dive |
| CVE-2026-109333 | SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH | surrealdb | surrealdb | Medium | 6.5 | 2026-10-12 16:05:22 | Deep Dive |
| CVE-2026-109334 | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use | surrealdb | surrealdb | High | 8.1 | 2026-10-12 16:05:22 | Deep Dive |
| CVE-2026-109332 | Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport | Jovancoding | Network-AI | Low | 3.1 | 2026-10-12 16:05:21 | Deep Dive |
| CVE-2026-109331 | Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget | Jovancoding | Network-AI | High | 7.4 | 2026-10-12 16:05:21 | Deep Dive |
| CVE-2026-109330 | Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer | Jovancoding | Network-AI | Medium | 4.3 | 2026-10-12 16:05:20 | Deep Dive |
| CVE-2026-109328 | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name | Admidio | admidio | Medium | 6.1 | 2026-10-12 16:05:19 | Deep Dive |
| CVE-2026-109329 | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php | Admidio | admidio | Medium | 6.5 | 2026-10-12 16:05:19 | Deep Dive |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php | Admidio | admidio | Medium | 6.1 | 2026-10-12 16:05:18 | Deep Dive |
| CVE-2026-109325 | Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy | getgrav | grav | High | 7.5 | 2026-10-12 16:05:17 | Deep Dive |
| CVE-2026-109326 | Grav before 2.1.7 Information Disclosure via Nested .git Directories | getgrav | grav | High | 7.5 | 2026-10-12 16:05:17 | Deep Dive |
| CVE-2026-109324 | Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms | getgrav | grav | Medium | 6.5 | 2026-10-12 16:05:15 | Deep Dive |
| CVE-2026-109323 | Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization | getgrav | grav-plugin-star-ratings | Medium | 5.3 | 2026-10-12 16:05:15 | Deep Dive |