https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-121423/https://vulnfeed.org/cve/CVE-2026-121423/Tue, 03 Nov 2026 14:28:19 +0000SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.https://vulnfeed.org/cve/CVE-2026-121419/https://vulnfeed.org/cve/CVE-2026-121419/Tue, 03 Nov 2026 14:28:16 +0000SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.https://vulnfeed.org/cve/CVE-2026-121417/https://vulnfeed.org/cve/CVE-2026-121417/Tue, 03 Nov 2026 14:28:15 +0000SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.https://vulnfeed.org/cve/CVE-2026-121416/https://vulnfeed.org/cve/CVE-2026-121416/Tue, 03 Nov 2026 14:28:14 +0000SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.