CVE-2026-109338Medium· 6.5▾ SunlitSurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via He…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44001High· 8.6vm2 is an open source vm/sandbox for Node.js
CVE-2026-109301Medium· 5.9Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process
CVE-2025-59538High· 7.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
CVE-2021-37714High· 7.5jsoup is a Java library for working with HTML
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107382Medium· 5.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases