CVEs we hold for Surrealdb
Records whose assigning authority named Surrealdb as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fieldssurrealdb CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scriptingsurrealdb CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512surrealdb CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parsersurrealdb CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotationssurrealdb CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statementsurrealdb CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessionssurrealdb CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Conditionsurrealdb CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clausesurrealdb CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Querysurrealdb CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Querysurrealdb CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwritesurrealdb CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patchsurrealdb CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocketsurrealdb CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECTsurrealdb CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messagessurrealdb CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC usesurrealdb CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversalsurrealdb CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-idsurrealdb CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirectsurrealdb CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirectsurrealdb CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNTsurrealdb CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statementsurrealdb CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypasssurrealdb CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERsurrealdb CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversalsurrealdb CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chainssurrealdb CVE-2026-63736SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolutionsurrealdb CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom APIsurrealdb CVE-2026-63734SurrealDB before 3.2.0 Denial of Service via malformed SurrealML importsurrealdb CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clausesurrealdb CVE-2026-63309SurrealDB < 3.1.5 Information Disclosure via ORDER BYsurrealdb CVE-2026-49997SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedsurrealdb CVE-2025-71398SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypasssurrealdb CVE-2025-71397SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopssurrealdb CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scriptingsurrealdb CVE-2025-71395SurrealDB before 2.2.2 Memory Exhaustion via string::replacesurrealdb CVE-2025-71394SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZERsurrealdb CVE-2025-71393SurrealDB before 2.2.2 Memory Exhaustion via Nested Functionssurrealdb CVE-2025-71392SurrealDB before 2.2.2 SurrealQL Injection via exportsurrealdb CVE-2025-71391SurrealDB before 2.2.2 Denial of Service via /sql endpointsurrealdb CVE-2025-71390SurrealDB before 2.3.6 deny-net Bypass via DNS Resolutionsurrealdb CVE-2024-58370SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Servicesurrealdb CVE-2024-58369SurrealDB before 1.1.1 Denial of Service via Global Parameterssurrealdb CVE-2024-58368SurrealDB before 1.1.0 Denial of Service via HTTP Headerssurrealdb CVE-2024-58367SurrealDB before 2.0.4 Improper Authorization via SELECT Permissionssurrealdb CVE-2024-58366SurrealDB before 1.1.1 Format String via Scripting Functionssurrealdb CVE-2024-58365SurrealDB before 1.2.0 Denial of Service via Nonexistent Functionsurrealdb CVE-2024-58364SurrealDB before 1.2.1 Denial of Service via Parsing Errorsurrealdb CVE-2024-58363SurrealDB before 1.5.4 Authentication Bypass via Database Switchsurrealdb CVE-2024-58362SurrealDB before 1.5.5 Query Injection via RPC APIsurrealdb CVE-2024-58361SurrealDB before 2.0.4 Denial of Service via Parser Exceptionsurrealdb CVE-2024-58359SurrealDB before 2.1.0 Denial of Service via rand() Sortingsurrealdb CVE-2024-58358SurrealDB before 2.1.0 Denial of Service via Nonexistent Rolesurrealdb CVE-2024-58357SurrealDB before 2.1.0 Denial of Service via rand::time()surrealdb CVE-2024-58356SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITEsurrealdb CVE-2023-54366SurrealDB before 1.0.1 Insecure Default Table Permissionssurrealdb 57 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.