SU
Product
surrealdb
69
CVEs
0
On KEV
8.8
Max CVSS
12
New 30D
Severity mix
Critical 0High 19Medium 50Low 0
Watch
Add surrealdb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63763 | 8.8 | Jul 20 | SurrealDB before 2.5.0 Privilege Escalation via Future Fields Affected: before 2.5.0; 3.0.0-alpha.1 before 3.0.0-beta.3 |
| CVE-2026-63757 | 8.8 | Jul 20 | SurrealDB before 3.1.0 Session Hijacking via /rpc sessions Affected: before 3.1.0 |
| CVE-2025-71390 | 8.8 | Jul 18 | SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution Affected: through 2.1.7; 2.2.0 before 2.2.6; 2.3.0 before 2.3.6; 3.0.0-alpha.1 through 3.0.0-alpha.7 |
| CVE-2024-58366 | 8.8 | Jul 18 | SurrealDB before 1.1.1 Format String via Scripting Functions Affected: before 1.1.1; before 0.4.2 |
| CVE-2024-58362 | 8.8 | Jul 18 | SurrealDB before 1.5.5 Query Injection via RPC API Affected: before 1.5.5; 2.0.0-beta.1 before 2.0.0-beta.3; before 1.5.2 |
| CVE-2023-54366 | 8.8 | Jul 18 | SurrealDB before 1.0.1 Insecure Default Table Permissions Affected: before 1.0.1 |
| CVE-2026-109343 | 8.1 | Oct 12 | SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement Affected: before 3.3.0 |
| CVE-2026-109334 | 8.1 | Oct 12 | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use Affected: before 3.3.0 |
| CVE-2026-102876 | 8.1 | Sep 29 | SurrealDB before 3.3.0 Cross-Tenant Access via Headers Affected: before 3.3.0 |
| CVE-2026-63756 | 8.1 | Jul 20 | SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Affected: before 3.1.0 |
| CVE-2026-63735 | 8.1 | Jul 20 | SurrealDB before 3.2.0 Authentication Bypass via Custom API Affected: before 3.2.0 |
| CVE-2025-71392 | 8.0 | Jul 18 | SurrealDB before 2.2.2 SurrealQL Injection via export Affected: before 2.2.2; before 2.1.5; before 2.0.5 |
| CVE-2026-63739 | 7.7 | Jul 20 | SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER Affected: before 3.1.5 |
| CVE-2025-71398 | 7.6 | Jul 18 | SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass Affected: before 2.2.2; before 2.1.5; before 2.0.5 |
| CVE-2026-63760 | 7.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service via JSON Parser Affected: before 3.1.0 |
| CVE-2026-63750 | 7.5 | Jul 20 | SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket Affected: before 3.1.0 |
| CVE-2026-63747 | 7.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service via malformed RPC use Affected: before 3.1.0 |
| CVE-2024-58368 | 7.5 | Jul 18 | SurrealDB before 1.1.0 Denial of Service via HTTP Headers Affected: before 1.1.0 |
| CVE-2026-109341 | 7.1 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations Affected: before 3.3.0 |
Showing 19