Vulnerability Database

GHSA-66r2-5gwj-gxm2

crates.io/surrealdb-core

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions 04 Sep

Fix available
Severity - 4.3 (Medium)

GHSA-848m-r628-vrxw

crates.io/surrealdb

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path 04 Sep

Fix available
Severity - 8.1 (High)

GHSA-m3c3-78fh-w3w7

crates.io/SurrealDB

SurrealDB allows bypass of deny-net flags via DNS resolution 04 Sep

Fix available
Severity - 5.8 (Medium)

GHSA-8rw6-p7m8-63jp

crates.io/surrealdb

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users 14 Aug

Fix available
Severity - 6.5 (Medium)

CVE-2026-63763

github.com/surrealdb/surrealdb

SurrealDB before 2.5.0 Privilege Escalation via Future Fields 20 Jul

Fix available
Severity - 7.5 (High)

CVE-2026-63762

github.com/surrealdb/surrealdb

SurrealDB before v2.6.1 Denial of Service via scripting 20 Jul

Fix available
Severity - 6.0 (Medium)

PYSEC-2026-3718

PyPI/surrealdb

See record for full details 18 Jul

Fix available
Severity - 8.7 (High)

CVE-2025-71398

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass 18 Jul

Fix available
Severity - 5.8 (Medium)

CVE-2025-71397

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops 18 Jul

Fix available
Severity - 7.1 (High)

CVE-2025-71396

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting 18 Jul

Fix available
Severity - 2.3 (Low)

CVE-2025-71395

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 Memory Exhaustion via string::replace 18 Jul

Fix available
Severity - 7.1 (High)

CVE-2025-71394

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER 18 Jul

Fix available
Severity - 2.3 (Low)

CVE-2025-71393

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions 18 Jul

Fix available
Severity - 6.0 (Medium)

CVE-2025-71392

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 SurrealQL Injection via export 18 Jul

Fix available
Severity - 9.4 (Critical)

CVE-2025-71391

github.com/surrealdb/surrealdb

SurrealDB before 2.2.2 Denial of Service via /sql endpoint 18 Jul

Fix available
Severity - 7.1 (High)

CVE-2025-71390

github.com/surrealdb/surrealdb

SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution 18 Jul

Fix available
Severity - 5.8 (Medium)

Vulnerabilities