CVE ID :CVE-2026-121419 Published : Nov. 3, 2026, 2:28 p.m. | 36 minutes ago Description :SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access....

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-121419 - SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

VERWANDTEARTIKEL

CVE-2026-28336 - SolarWinds Dameware Command Injection Vulnerability

CVE-2026-28335 - SolarWinds Dameware Buffer Overflow Vulnerability

CVE-2026-28327 - SolarWinds Dameware DLL Hijacking Vulnerability

CVE-2026-103916 - Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

CVE-2026-73328 - Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

CVE-2026-121557 - WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot