[ Vendor · 12 CVEs ]
surrealdb
CVEs affecting surrealdb published in the last 30 days, plus any surrealdb CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109338 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header… | |
| CVE-2026-109339 | 12 Oct 2026 | CVSS 4.9 | surrealdbSurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory… | |
| CVE-2026-109340 | 12 Oct 2026 | CVSS 5.4 | surrealdbSurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by… | |
| CVE-2026-109341 | 12 Oct 2026 | CVSS 7.1 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted… | |
| CVE-2026-109342 | 12 Oct 2026 | CVSS 5.4 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or… | |
| CVE-2026-109343 | 12 Oct 2026 | CVSS 8.1 | surrealdbSurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking… | |
| CVE-2026-109333 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other… | |
| CVE-2026-109334 | 12 Oct 2026 | CVSS 8.1 | surrealdbSurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user… | |
| CVE-2026-109335 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level… | |
| CVE-2026-109336 | 12 Oct 2026 | CVSS 4.3 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT… | |
| CVE-2026-109337 | 12 Oct 2026 | CVSS 4.3 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT… | |
| CVE-2026-102876 | 29 Sep 2026 | CVSS 8.1 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS… |