CVE Feed

    Dashboard / CVE / CVE-2025-11060

    CVE-2025-11060

    A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

    Published:Sep 11, 2025
    Last Modified:Apr 15, 2026
    EPS:Sep 26, 2025
    EPSS Score:0.00041
    CVSS Score:5.7

    Affected Products

    Vendor
    Redhat
    Product
    Service Mesh

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-12143 (CVSS 8.7) — form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `fiel…
    CVE-2026-46625 (CVSS 7.5) — JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's i…
    CVE-2026-11332 (CVSS 7.8) — A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications …
    CVE-2026-42044 (CVSS 6.5) — Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios librar…
    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …
    CVE-2025-6547 (CVSS 9.1) — Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue …
    CVE-2025-6545 (CVSS 9.1) — Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulne…
    CVE-2025-22871 (CVSS 9.1) — The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This …
    CVE-2025-26791 (CVSS 4.5) — DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cro…
    CVE-2025-22866 (CVSS 4) — Due to the usage of a variable time instruction in the assembly implementation of an internal function, a smal…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High