CVE-2026-63763 | High | 8.8 | 2026-07-20 | SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database… |
CVE-2026-63762 | Medium | 6.5 | 2026-07-20 | SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via… |
CVE-2026-63761 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORIT… |
CVE-2026-63760 | High | 7.5 | 2026-07-20 | SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parenthes… |
CVE-2026-63759 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can sen… |
CVE-2026-63758 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other… |
CVE-2026-63757 | High | 8.8 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentica… |
CVE-2026-63756 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit au… |
CVE-2026-63755 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE K… |
CVE-2026-63754 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CRE… |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |
CVE-2026-63752 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwri… |
CVE-2026-63751 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protecte… |
CVE-2026-63750 | Medium | 5.3 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffe… |
CVE-2026-63749 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $b… |
CVE-2026-63748 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by fi… |
CVE-2026-63747 | High | 7.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticate… |
CVE-2026-63746 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records f… |
CVE-2026-63745 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing t… |
CVE-2026-63744 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targ… |
CVE-2026-63743 | Medium | 6.4 | 2026-07-20 | SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-ne… |
CVE-2026-63742 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries o… |
CVE-2026-63741 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated… |
CVE-2026-63740 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead… |
CVE-2026-63739 | High | 7.7 | 2026-07-20 | SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles… |
CVE-2026-63738 | Medium | 4.3 | 2026-07-20 | SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals… |
CVE-2026-63737 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of… |
CVE-2026-63736 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists… |
CVE-2026-63735 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in differe… |
CVE-2026-63734 | Medium | 4.9 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash th… |
CVE-2026-63733 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement… |
CVE-2025-71398 | | | 2026-07-18 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to block… |
CVE-2025-71397 | Medium | 6.5 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or data… |
CVE-2025-71396 | Medium | 6.5 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions w… |
CVE-2025-71395 | | | 2026-07-18 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when u… |
CVE-2025-71394 | Medium | 4.3 | 2026-07-18 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary file… |
CVE-2025-71393 | Medium | 6.5 | 2026-07-18 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new quer… |
CVE-2025-71392 | High | 8.0 | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authen… |
CVE-2025-71391 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers… |
CVE-2025-71390 | High | 8.8 | 2026-07-18 | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restriction… |
CVE-2024-58370 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idio… |
CVE-2024-58369 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Auth… |
CVE-2024-58368 | High | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated atta… |
CVE-2024-58367 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access un… |
CVE-2024-58366 | High | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scriptin… |
CVE-2024-58365 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Auth… |
CVE-2024-58364 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator char… |
CVE-2024-58363 | Medium | 6.3 | 2026-07-18 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an aut… |
CVE-2024-58362 | High | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively… |
CVE-2024-58361 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authoriz… |
CVE-2024-58359 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can ex… |
CVE-2024-58358 | Medium | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexisten… |
CVE-2024-58357 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result fro… |
CVE-2024-58356 | Medium | 6.3 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. B… |
CVE-2023-54366 | High | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici… |
CVE-2026-63309 | Medium | 4.3 | 2026-07-17 | SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restrict… |
CVE-2026-49997 | Medium | 5.4 | 2026-07-15 | SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/… |