surrealdb

Products

Exploited and recent CVEs

• CVE-2026-121423 Medium 6.5 SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization 0.3%
• CVE-2026-121422 Medium 4.1 SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass 0.2%
• CVE-2026-121421 Medium 4.3 SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass 0.3%
• CVE-2026-121420 Low 3.3 SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses 0.2%
• CVE-2026-121419 High 8.1 SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision 0.3%
• CVE-2026-121418 Medium 4.3 SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner 0.2%
• CVE-2026-121417 High 7.8 SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends 0.2%
• CVE-2026-121416 High 7.1 SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations 0.3%
• CVE-2026-109343 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement 0.3%
• CVE-2026-109342 Medium 5.4 SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method 0.3%
• CVE-2026-109341 High 7.1 SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations 0.3%
• CVE-2026-109340 Medium 5.4 SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE 0.2%
• CVE-2026-109339 Medium 4.9 SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering 0.4%
• CVE-2026-109339 Medium 4.9 SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering 0.4%
• CVE-2026-109338 Medium 6.5 SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values 0.3%
• CVE-2026-109337 Medium 4.3 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause 0.2%
• CVE-2026-109336 Medium 4.3 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after 0.2%
• CVE-2026-109335 Medium 6.5 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields 0.3%
• CVE-2026-109334 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use 0.3%
• CVE-2026-109333 Medium 6.5 SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH 0.3%
• CVE-2026-102876 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via Headers 0.3%
• CVE-2026-63763 High 7.5 SurrealDB before 2.5.0 Privilege Escalation via Future Fields 0.5%
• CVE-2026-63762 Medium 6.0 SurrealDB before v2.6.1 Denial of Service via scripting 0.4%
• CVE-2026-63761 Medium 4.3 SurrealDB before 3.1.0 Algorithm Downgrade via ES512 0.3%
• CVE-2026-63760 High 7.5 SurrealDB before 3.1.0 Denial of Service via JSON Parser 0.5%
• CVE-2026-63759 Medium 6.5 SurrealDB before 3.1.0 Denial of Service nested type annotations 0.4%
• CVE-2026-63758 Medium 5.4 SurrealDB before 3.1.0 Authorization Bypass via KILL Statement 0.3%
• CVE-2026-63757 High 8.8 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions 0.5%
• CVE-2026-63756 High 8.1 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition 0.4%
• CVE-2026-63755 Medium 6.5 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause 0.4%