Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwritecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patchcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocketcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECTcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messagescrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC usecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversalcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-idcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirectcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirectcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNTcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statementcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypasscrates.io · surrealdb · fixed in 3.1.4
- CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversalcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chainscrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom APIcrates.io · surrealdb · fixed in 3.2.0
- CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clausecrates.io · surrealdb-core · fixed in 3.2.0
- CVE-2025-71398SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypasscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71397SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scriptingcrates.io · surrealdb · fixed in 2.2.2, 2.0.5, 2.1.5
- CVE-2025-71395SurrealDB before 2.2.2 Memory Exhaustion via string::replacecrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71394SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZERcrates.io · surrealdb · fixed in 2.2.2, 2.1.5
- CVE-2025-71393SurrealDB before 2.2.2 Memory Exhaustion via Nested Functionscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71392SurrealDB before 2.2.2 SurrealQL Injection via exportcrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71391SurrealDB before 2.2.2 Denial of Service via /sql endpointcrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71390SurrealDB before 2.3.6 deny-net Bypass via DNS Resolutioncrates.io · surrealdb · fixed in 2.1.8, 2.2.6, 3.0.0-alpha.7 and more
- CVE-2024-58370SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Servicecrates.io · surrealdb · fixed in 1.1.0
- CVE-2024-58369SurrealDB before 1.1.1 Denial of Service via Global Parameterscrates.io · surrealdb · fixed in 1.1.1
- CVE-2024-58368SurrealDB before 1.1.0 Denial of Service via HTTP Headerscrates.io · surrealdb · fixed in 1.1.0