SU
Vendor
surrealdb
70
CVEs
0
On KEV
13
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109343 | SU surrealdb surrealdb | 8.1 | Oct 12 | SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement |
| CVE-2026-109342 | SU surrealdb surrealdb | 5.4 | Oct 12 | SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method |
| CVE-2026-109341 | SU surrealdb surrealdb | 7.1 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations |
| CVE-2026-109340 | SU surrealdb surrealdb | 5.4 | Oct 12 | SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE |
| CVE-2026-109339 | SU surrealism-runtime surrealdb | 4.9 | Oct 12 | SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering |
| CVE-2026-109338 | SU surrealdb surrealdb | 6.5 | Oct 12 | SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values |
| CVE-2026-109337 | SU surrealdb surrealdb | 4.3 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause |
| CVE-2026-109336 | SU surrealdb surrealdb | 4.3 | Oct 12 | SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after |
| CVE-2026-109335 | SU surrealdb surrealdb | 6.5 | Oct 12 | SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields |
| CVE-2026-109334 | SU surrealdb surrealdb | 8.1 | Oct 12 | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use |
| CVE-2026-109333 | SU surrealdb surrealdb | 6.5 | Oct 12 | SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH |
| CVE-2026-102876 | SU surrealdb surrealdb | 8.1 | Sep 29 | SurrealDB before 3.3.0 Cross-Tenant Access via Headers |
| CVE-2026-63763 | SU surrealdb surrealdb | 8.8 | Jul 20 | SurrealDB before 2.5.0 Privilege Escalation via Future Fields |
| CVE-2026-63762 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before v2.6.1 Denial of Service via scripting |
| CVE-2026-63761 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Algorithm Downgrade via ES512 |
| CVE-2026-63760 | SU surrealdb surrealdb | 7.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service via JSON Parser |
| CVE-2026-63759 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service nested type annotations |
| CVE-2026-63758 | SU surrealdb surrealdb | 5.4 | Jul 20 | SurrealDB before 3.1.0 Authorization Bypass via KILL Statement |
| CVE-2026-63757 | SU surrealdb surrealdb | 8.8 | Jul 20 | SurrealDB before 3.1.0 Session Hijacking via /rpc sessions |
| CVE-2026-63756 | SU surrealdb surrealdb | 8.1 | Jul 20 | SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition |
| CVE-2026-63755 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.0 Permission Bypass via WHERE Clause |
| CVE-2026-63754 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service via LIVE Query |
| CVE-2026-63753 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Authentication Bypass via LIVE Query |
| CVE-2026-63752 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 RELATE Statement Record Overwrite |
| CVE-2026-63751 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch |
| CVE-2026-63750 | SU surrealdb surrealdb | 7.5 | Jul 20 | SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket |
| CVE-2026-63749 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT |
| CVE-2026-63748 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Information Disclosure via Error Messages |
| CVE-2026-63747 | SU surrealdb surrealdb | 7.5 | Jul 20 | SurrealDB before 3.1.0 Denial of Service via malformed RPC use |
| CVE-2026-63746 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.0 Permission Bypass via Graph Traversal |
| CVE-2026-63745 | SU surrealdb surrealdb | 5.4 | Jul 20 | SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id |
| CVE-2026-63744 | SU surrealdb surrealdb | 4.1 | Jul 20 | SurrealDB before 3.1.5 SSRF via JWKS URL Redirect |
| CVE-2026-63743 | SU surrealdb surrealdb | 6.4 | Jul 20 | SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect |
| CVE-2026-63742 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT |
| CVE-2026-63741 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.0 Authentication Bypass via USE statement |
| CVE-2026-63740 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.4 Array Element Permission Bypass |
| CVE-2026-63739 | SU surrealdb surrealdb | 7.7 | Jul 20 | SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER |
| CVE-2026-63738 | SU surrealdb surrealdb | 4.3 | Jul 20 | SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal |
| CVE-2026-63737 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.1.5 Denial of Service via deep operator chains |
| CVE-2026-63736 | SU surrealdb surrealdb | 4.1 | Jul 20 | SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution |
| CVE-2026-63735 | SU surrealdb surrealdb | 8.1 | Jul 20 | SurrealDB before 3.2.0 Authentication Bypass via Custom API |
| CVE-2026-63734 | SU surrealdb surrealdb | 4.9 | Jul 20 | SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import |
| CVE-2026-63733 | SU surrealdb surrealdb | 6.5 | Jul 20 | SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause |
| CVE-2025-71398 | SU surrealdb surrealdb | 7.6 | Jul 18 | SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass |
| CVE-2025-71397 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops |
| CVE-2025-71396 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting |
| CVE-2025-71395 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.2.2 Memory Exhaustion via string::replace |
| CVE-2025-71394 | SU surrealdb surrealdb | 4.3 | Jul 18 | SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER |
| CVE-2025-71393 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions |
| CVE-2025-71392 | SU surrealdb surrealdb | 8.0 | Jul 18 | SurrealDB before 2.2.2 SurrealQL Injection via export |
| CVE-2025-71391 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.2.2 Denial of Service via /sql endpoint |
| CVE-2025-71390 | SU surrealdb surrealdb | 8.8 | Jul 18 | SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution |
| CVE-2024-58370 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service |
| CVE-2024-58369 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 1.1.1 Denial of Service via Global Parameters |
| CVE-2024-58368 | SU surrealdb surrealdb | 7.5 | Jul 18 | SurrealDB before 1.1.0 Denial of Service via HTTP Headers |
| CVE-2024-58367 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions |
| CVE-2024-58366 | SU surrealdb surrealdb | 8.8 | Jul 18 | SurrealDB before 1.1.1 Format String via Scripting Functions |
| CVE-2024-58365 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 1.2.0 Denial of Service via Nonexistent Function |
| CVE-2024-58364 | SU surrealdb surrealdb | 6.5 | Jul 18 | SurrealDB before 1.2.1 Denial of Service via Parsing Error |
| CVE-2024-58363 | SU surrealdb surrealdb | 6.3 | Jul 18 | SurrealDB before 1.5.4 Authentication Bypass via Database Switch |