Skip to content
Threat Feed
Subscribe

Tag

Database-Vulnerability

2 briefs RSS
high advisory

SurrealDB RPC API Arbitrary Object Execution Vulnerability

An unauthenticated remote code execution vulnerability exists in SurrealDB's RPC API, affecting versions prior to 1.5.5 and 2.0.0-beta prior to 2.0.0-beta.3, allowing attackers to inject a specially crafted binary object containing a subquery during signin or signup operations, leading to execution with editor-level privileges and manipulation of non-IAM database resources.

SurrealDB +1 database-vulnerability remote-code-execution unauthenticated-access data-manipulation
3t 1c
critical advisory

PraisonAI SQL/CQL Injection via Unvalidated PGVector/Cassandra Dimension (CVE-2026-60090)

PraisonAI versions before 4.6.78 are vulnerable to SQL/CQL injection, allowing an attacker to inject malicious SQL/CQL tokens into generated CREATE TABLE DDL statements by influencing the unvalidated 'dimension' argument in PGVector and Cassandra knowledge-store backends, potentially leading to arbitrary database command execution and data manipulation or destruction.

PraisonAI before 4.6.78 sql-injection cql-injection data-destruction praisonai database-vulnerability
2t 1c