SU
Product
surrealdb
69
CVEs
0
On KEV
8.8
Max CVSS
12
New 30D
Severity mix
Critical 0High 19Medium 50Low 0
Watch
Add surrealdb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63745 | 5.4 | Jul 20 | SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id Affected: before 3.1.0 |
| CVE-2026-49997 | 5.4 | Jul 15 | SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted Affected: < 3.1.0 |
| CVE-2026-109339 | 4.9 | Oct 12 | SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering Affected: 3.1.0 before 3.3.0 |
| CVE-2026-63734 | 4.9 | Jul 20 | SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import Affected: before 3.2.0 |
| CVE-2024-58358 | 4.9 | Jul 18 | SurrealDB before 2.1.0 Denial of Service via Nonexistent Role Affected: before 2.1.0; before 2.1.0 |
| CVE-2026-109337 | 4.3 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause Affected: before 3.3.0 |
| CVE-2026-109336 | 4.3 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after Affected: before 3.3.0 |
| CVE-2026-63761 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Algorithm Downgrade via ES512 Affected: before 3.1.0 |
| CVE-2026-63753 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Authentication Bypass via LIVE Query Affected: before 3.1.0 |
| CVE-2026-63752 | 4.3 | Jul 20 | SurrealDB before 3.1.0 RELATE Statement Record Overwrite Affected: before 3.1.0 |
| CVE-2026-63751 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch Affected: before 3.1.0 |
| CVE-2026-63749 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT Affected: before 3.1.0 |
| CVE-2026-63748 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Information Disclosure via Error Messages Affected: before 3.1.0 |
| CVE-2026-63742 | 4.3 | Jul 20 | SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT Affected: before 3.1.0 |
| CVE-2026-63738 | 4.3 | Jul 20 | SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal Affected: 3.1.0 before 3.1.5 |
| CVE-2025-71394 | 4.3 | Jul 18 | SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER Affected: before 2.2.2; before 2.1.5 |
| CVE-2026-63309 | 4.3 | Jul 17 | SurrealDB < 3.1.5 Information Disclosure via ORDER BY Affected: 3.0.0 before 3.1.5 |
| CVE-2026-63744 | 4.1 | Jul 20 | SurrealDB before 3.1.5 SSRF via JWKS URL Redirect Affected: before 3.1.5 |
| CVE-2026-63736 | 4.1 | Jul 20 | SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution Affected: before 3.2.0 |