Aauthzed

Products

Exploited and recent CVEs

• CVE-2026-55866 Low 3.7 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected 0.3%
• CVE-2026-46668 Low 2.3 SpiceDB: Caveat structures with nested lists can result in improper cache reuse 0.3%
• CVE-2026-40091 Medium 6.0 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs 0.2%
• CVE-2025-65111 Low 2.9 SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results 0.2%
• CVE-2025-64529 Low 2.7 SpiceDB's WriteRelationships fails silently if payload is too big 0.3%
• CVE-2025-49011 Low 3.7 SpiceDB checks involving relations with caveats can result in no permission when permission is expected 0.3%
• CVE-2024-48909 Low 2.0 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not 0.3%
• CVE-2024-46989 Low 3.7 Multiple caveats on resources of the same type can result in no permission when permission is expected 0.3%
• CVE-2024-38361 Low 3.7 Permissions processing error in spacedb 0.4%
• CVE-2024-32001 Low 2.2 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used 0.6%
• CVE-2024-27101 High 7.3 Integer overflow in chunking helper causes dispatching to miss elements or panic 0.5%
• CVE-2023-46255 Medium 4.2 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed 0.4%
• CVE-2023-35930 Low 3.7 LookupResources may return partial results in spicedb 0.4%
• CVE-2023-29193 High 8.7 SpiceDB binding metrics port to untrusted networks and can leak command-line flags 0.8%
• CVE-2022-21646 High 8.1 Lookup operations do not take into account wildcards in SpiceDB 1.3%