Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chainscrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom APIcrates.io · surrealdb · fixed in 3.2.0
- CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clausecrates.io · surrealdb-core · fixed in 3.2.0
- CVE-2026-45138CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation RulePackagist · ci4-cms-erp/ci4ms · fixed in 0.31.9.0
- CVE-2026-12484Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_configPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-16221fast-uri vulnerable to host confusion via literal backslash authority delimiternpm · fast-uri · fixed in 2.4.3, 3.1.4, 4.1.1
- CVE-2025-71398SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypasscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71397SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scriptingcrates.io · surrealdb · fixed in 2.2.2, 2.0.5, 2.1.5
- CVE-2025-71395SurrealDB before 2.2.2 Memory Exhaustion via string::replacecrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71394SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZERcrates.io · surrealdb · fixed in 2.2.2, 2.1.5
- CVE-2025-71393SurrealDB before 2.2.2 Memory Exhaustion via Nested Functionscrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71392SurrealDB before 2.2.2 SurrealQL Injection via exportcrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71391SurrealDB before 2.2.2 Denial of Service via /sql endpointcrates.io · surrealdb · fixed in 2.2.2, 2.1.5, 2.0.5
- CVE-2025-71390SurrealDB before 2.3.6 deny-net Bypass via DNS Resolutioncrates.io · surrealdb · fixed in 2.1.8, 2.2.6, 3.0.0-alpha.7 and more
- CVE-2024-58370SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Servicecrates.io · surrealdb · fixed in 1.1.0
- CVE-2024-58369SurrealDB before 1.1.1 Denial of Service via Global Parameterscrates.io · surrealdb · fixed in 1.1.1
- CVE-2024-58368SurrealDB before 1.1.0 Denial of Service via HTTP Headerscrates.io · surrealdb · fixed in 1.1.0
- CVE-2024-58367SurrealDB before 2.0.4 Improper Authorization via SELECT Permissionscrates.io · surrealdb, surrealdb-core · fixed in 2.0.4
- CVE-2024-58366SurrealDB before 1.1.1 Format String via Scripting Functionscrates.io · surrealdb · fixed in 1.1.1
- CVE-2024-58365SurrealDB before 1.2.0 Denial of Service via Nonexistent Functioncrates.io · surrealdb · fixed in 1.2.0
- CVE-2024-58364SurrealDB before 1.2.1 Denial of Service via Parsing Errorcrates.io · surrealdb · fixed in 1.2.1
- CVE-2024-58363SurrealDB before 1.5.4 Authentication Bypass via Database Switchcrates.io · surrealdb, surrealdb-core · fixed in 1.5.4, 2.0.0-alpha.6, 1.5.1
- CVE-2024-58362SurrealDB before 1.5.5 Query Injection via RPC APIcrates.io · surrealdb, surrealdb-core · fixed in 1.5.5, 2.0.0-beta.3, 1.5.2
- CVE-2024-58361SurrealDB before 2.0.4 Denial of Service via Parser Exceptioncrates.io · surrealdb, surrealdb-core · fixed in 2.0.4
- CVE-2024-58359SurrealDB before 2.1.0 Denial of Service via rand() Sortingcrates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58358SurrealDB before 2.1.0 Denial of Service via Nonexistent Rolecrates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58357SurrealDB before 2.1.0 Denial of Service via rand::time()crates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58356SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITEcrates.io · surrealdb, surrealdb-core · fixed in 2.1.4
- CVE-2023-54366SurrealDB before 1.0.1 Insecure Default Table PermissionsPyPI · surrealdb · fixed in 1.0.1