漏洞公告

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Rancher vulnerable to command injection through unsanitized YAML parameter

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

QUIC has Broken TLS verification

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions

SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission

SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required

SurrealDB has an Authorization Bypass via Composite Record-id Paths

SurrealDB: Graph traversal bypasses table SELECT permissions