Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-102876
  • github.com/surrealdb/surrealdb
 SurrealDB before 3.3.0 Cross-Tenant Access via Headers 6 days ago
  • Fix available
  • Severity - 8.6 (High)
GHSA-66r2-5gwj-gxm2
  • crates.io/surrealdb-core
 SurrealDB: Writes in a PERMISSIONS clause bypass table permissions 04 Sep
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-848m-r628-vrxw
  • crates.io/surrealdb
 SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path 04 Sep
  • Fix available
  • Severity - 8.1 (High)
GHSA-m3c3-78fh-w3w7
  • crates.io/SurrealDB
 SurrealDB allows bypass of deny-net flags via DNS resolution 04 Sep
  • Fix available
  • Severity - 5.8 (Medium)
GHSA-8rw6-p7m8-63jp
  • crates.io/surrealdb
 SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users 14 Aug
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-63763
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.5.0 Privilege Escalation via Future Fields 20 Jul
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-63762
  • github.com/surrealdb/surrealdb
 SurrealDB before v2.6.1 Denial of Service via scripting 20 Jul
  • Fix available
  • Severity - 6.0 (Medium)
PYSEC-2026-3718
  • PyPI/surrealdb
 See record for full details 18 Jul
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-71398
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass 18 Jul
  • Fix available
  • Severity - 5.8 (Medium)
CVE-2025-71397
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops 18 Jul
  • Fix available
  • Severity - 7.1 (High)
CVE-2025-71396
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting 18 Jul
  • Fix available
  • Severity - 2.3 (Low)
CVE-2025-71395
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 Memory Exhaustion via string::replace 18 Jul
  • Fix available
  • Severity - 7.1 (High)
CVE-2025-71394
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER 18 Jul
  • Fix available
  • Severity - 2.3 (Low)
CVE-2025-71393
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions 18 Jul
  • Fix available
  • Severity - 6.0 (Medium)
CVE-2025-71392
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 SurrealQL Injection via export 18 Jul
  • Fix available
  • Severity - 9.4 (Critical)
CVE-2025-71391
  • github.com/surrealdb/surrealdb
 SurrealDB before 2.2.2 Denial of Service via /sql endpoint 18 Jul
  • Fix available
  • Severity - 7.1 (High)
Load more...