surrealdb surrealdb

• CVE-2026-121423 Medium 6.5 SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization 0.3%
• CVE-2026-121422 Medium 4.1 SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass 0.2%
• CVE-2026-121421 Medium 4.3 SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass 0.3%
• CVE-2026-121420 Low 3.3 SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses 0.2%
• CVE-2026-121419 High 8.1 SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision 0.3%
• CVE-2026-121418 Medium 4.3 SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner 0.2%
• CVE-2026-121417 High 7.8 SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends 0.2%
• CVE-2026-121416 High 7.1 SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations 0.3%
• CVE-2026-109343 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement 0.3%
• CVE-2026-109342 Medium 5.4 SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method 0.3%
• CVE-2026-109341 High 7.1 SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations 0.3%
• CVE-2026-109340 Medium 5.4 SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE 0.2%
• CVE-2026-109339 Medium 4.9 SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering 0.4%
• CVE-2026-109338 Medium 6.5 SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values 0.3%
• CVE-2026-109337 Medium 4.3 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause 0.2%
• CVE-2026-109336 Medium 4.3 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after 0.2%
• CVE-2026-109335 Medium 6.5 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields 0.3%
• CVE-2026-109334 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use 0.3%
• CVE-2026-109333 Medium 6.5 SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH 0.3%
• CVE-2026-102876 High 8.1 SurrealDB before 3.3.0 Cross-Tenant Access via Headers 0.3%
• CVE-2026-63763 High 7.5 SurrealDB before 2.5.0 Privilege Escalation via Future Fields 0.5%
• CVE-2026-63762 Medium 6.0 SurrealDB before v2.6.1 Denial of Service via scripting 0.4%
• CVE-2026-63761 Medium 4.3 SurrealDB before 3.1.0 Algorithm Downgrade via ES512 0.3%
• CVE-2026-63760 High 7.5 SurrealDB before 3.1.0 Denial of Service via JSON Parser 0.5%
• CVE-2026-63759 Medium 6.5 SurrealDB before 3.1.0 Denial of Service nested type annotations 0.4%
• CVE-2026-63758 Medium 5.4 SurrealDB before 3.1.0 Authorization Bypass via KILL Statement 0.3%
• CVE-2026-63757 High 8.8 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions 0.5%
• CVE-2026-63756 High 8.1 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition 0.4%
• CVE-2026-63755 Medium 6.5 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause 0.4%
• CVE-2026-63754 Medium 6.5 SurrealDB before 3.1.0 Denial of Service via LIVE Query 0.4%
• CVE-2026-63753 Medium 4.3 SurrealDB before 3.1.0 Authentication Bypass via LIVE Query 0.4%
• CVE-2026-63752 Medium 4.3 SurrealDB before 3.1.0 RELATE Statement Record Overwrite 0.3%
• CVE-2026-63751 Medium 4.3 SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch 0.3%
• CVE-2026-63750 Medium 5.3 SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket 0.5%
• CVE-2026-63749 Medium 4.3 SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT 0.4%
• CVE-2026-63748 Medium 4.3 SurrealDB before 3.1.0 Information Disclosure via Error Messages 0.3%
• CVE-2026-63747 High 7.5 SurrealDB before 3.1.0 Denial of Service via malformed RPC use 0.5%
• CVE-2026-63746 Medium 6.5 SurrealDB before 3.1.0 Permission Bypass via Graph Traversal 0.4%
• CVE-2026-63745 Medium 5.4 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id 0.2%
• CVE-2026-63744 Medium 4.1 SurrealDB before 3.1.5 SSRF via JWKS URL Redirect 0.3%
• CVE-2026-63743 Medium 6.4 SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect 0.2%
• CVE-2026-63742 Medium 4.3 SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT 0.3%
• CVE-2026-63741 Medium 6.5 SurrealDB before 3.1.0 Authentication Bypass via USE statement 0.4%
• CVE-2026-63740 Medium 6.5 SurrealDB before 3.1.4 Array Element Permission Bypass 0.4%
• CVE-2026-63739 High 7.7 SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER 0.5%
• CVE-2026-63738 Medium 4.3 SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal 0.3%
• CVE-2026-63737 Medium 6.5 SurrealDB before 3.1.5 Denial of Service via deep operator chains 0.5%
• CVE-2026-63736 Medium 4.1 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution 0.3%
• CVE-2026-63735 High 8.1 SurrealDB before 3.2.0 Authentication Bypass via Custom API 0.4%
• CVE-2026-63734 Medium 4.9 SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import 0.5%