Product by Surrealdb
SurrealDB
77 known vulnerabilities in SurrealDB (Surrealdb), 0 of them actively exploited (CISA KEV).
Key figures
77
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-58368 | SurrealDB before 1.1.0 Denial of Service via HTTP Headers | 7.5 | |
| High | CVE-2024-58362 | SurrealDB before 1.5.5 Query Injection via RPC API | 8.8 | |
| Critical | CVE-2024-58366 | SurrealDB before 1.1.1 Format String via Scripting Functions | 8.5 | |
| High | CVE-2026-63757 | SurrealDB before 3.1.0 Session Hijacking via /rpc sessions | 8.8 | |
| High | CVE-2026-63760 | SurrealDB before 3.1.0 Denial of Service via JSON Parser | 7.5 | |
| High | CVE-2026-63747 | SurrealDB before 3.1.0 Denial of Service via malformed RPC use | 7.5 | |
| Critical | CVE-2025-71392 | SurrealDB before 2.2.2 SurrealQL Injection via export | 8.0 | |
| High | CVE-2026-63763 | SurrealDB before 2.5.0 Privilege Escalation via Future Fields | 8.8 | |
| High | CVE-2026-121419 | SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision | 8.1 | |
| High | CVE-2023-54366 | SurrealDB before 1.0.1 Insecure Default Table Permissions | 8.8 | |
| High | CVE-2025-71390 | SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution | 8.8 | |
| High | CVE-2026-63739 | SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER | 7.7 | |
| High | CVE-2026-109343 | SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement | 8.1 | |
| High | CVE-2026-109334 | SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use | 8.1 | |
| High | CVE-2026-121417 | SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends | 7.8 | |
| Critical | CVE-2026-63756 | SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition | 8.1 | |
| High | CVE-2026-102876 | SurrealDB before 3.3.0 Cross-Tenant Access via Headers | 8.1 | |
| High | CVE-2025-71391 | SurrealDB before 2.2.2 Denial of Service via /sql endpoint | 6.5 | |
| High | CVE-2025-71397 | SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops | 6.5 | |
| Medium | CVE-2026-109339 | SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering | 4.9 | |
| High | CVE-2026-121423 | SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization | 6.5 | |
| High | CVE-2026-63735 | SurrealDB before 3.2.0 Authentication Bypass via Custom API | 8.1 | |
| High | CVE-2026-121416 | SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations | 7.1 | |
| High | CVE-2026-63737 | SurrealDB before 3.1.5 Denial of Service via deep operator chains | 6.5 | |
| High | CVE-2026-109338 | SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values | 6.5 |