Surrealdb vulnerabilities
77 CVEs and advisories name Surrealdb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Query
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwrite
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
- CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT
- CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messages
- CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
- CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
- CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirect
- CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
- CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT
- CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statement
- CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypass
- CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER
- CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal
- CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chains
- CVE-2026-63736SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution
- CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom API
- CVE-2026-63734SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import
- CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
- CVE-2025-71398SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass
- CVE-2025-71397SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops
- CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting
- CVE-2025-71395SurrealDB before 2.2.2 Memory Exhaustion via string::replace
- CVE-2025-71394SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
- CVE-2025-71393SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions
- CVE-2025-71392SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2025-71391SurrealDB before 2.2.2 Denial of Service via /sql endpoint
- CVE-2025-71390SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution