https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:03:15.851300+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-63756 CVE-2026-63756 — SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition 2026-10-07T13:03:15.868873+00:00

Affected: surrealdb

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.