Search
80 CVEs · published 2026-07-18 to 2026-07-18
CVEs (80)
Showing 1–25 of 80
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-54366 | HIGH | Patched | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions… |
| CVE-2024-58356 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table … |
| CVE-2024-58357 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_o… |
| CVE-2024-58358 | MEDIUM | Patched | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Atta… |
| CVE-2024-58359 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries… |
| CVE-2024-58361 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients ca… |
| CVE-2024-58362 | HIGH | Patched | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it… |
| CVE-2024-58363 | MEDIUM | Patched | 6.3 | 2026-07-18 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated se… |
| CVE-2024-58364 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Autho… |
| CVE-2024-58365 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized client… |
| CVE-2024-58366 | HIGH | Patched | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges … |
| CVE-2024-58367 | NONE | Patched | — | 2026-07-18 | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized fi… |
| CVE-2024-58368 | HIGH | Patched | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can sen… |
| CVE-2024-58369 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized client… |
| CVE-2024-58370 | MEDIUM | Patched | 6.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorize… |
| CVE-2025-71390 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http… |
| CVE-2025-71391 | NONE | Patched | — | 2026-07-18 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send craf… |
| CVE-2025-71392 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated Syste… |
| CVE-2025-71393 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenti… |
| CVE-2025-71394 | NONE | Patched | — | 2026-07-18 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file… |
| CVE-2025-71395 | NONE | Patched | — | 2026-07-18 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex pa… |
| CVE-2025-71396 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scrip… |
| CVE-2025-71397 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) t… |
| CVE-2025-71398 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP address… |
| CVE-2026-10130 | HIGH | 8.2 | 2026-07-18 | QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signu… |